PT-2020-14243 · Apollo · Apollo-Adminservice

Lexu · Published 2020-09-10 · Updated 2021-11-18 · CVE-2020-15170

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions apollo-adminservice versions prior to 1.7.1

Description The issue arises when apollo-adminservice is exposed to the internet, which is not recommended, as it is designed to work in an intranet and lacks built-in access controls. This could allow malicious hackers to access apollo-adminservice APIs directly, potentially accessing or editing the application's configurations.

Recommendations For versions prior to 1.7.1, to fix the potential issue without upgrading, simply follow the advice to not expose apollo-adminservice to the internet. For version 1.7.1 and later, no additional actions are required as access control for admin service was added in this version.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-15170

GHSA-XPMX-H7XQ-XFFH

Affected Products

Apollo-Adminservice

References · 6

• https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf · Patch
• https://osv.dev/vulnerability/CVE-2020-15170 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15170 · Security Note
• https://osv.dev/vulnerability/GHSA-xpmx-h7xq-xffh · Vendor Advisory
• https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh · Note
• https://github.com/ctripcorp/apollo · Note