PT-2021-20072 · Apache · Apache Apisix Dashboard

Junxu Chen · Published 2021-06-08 · Updated 2024-03-06 · CVE-2021-33190

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache APISIX Dashboard version 2.6

Description The issue arises from a combination of factors, including a change in the default listen host to 0.0.0.0 to facilitate external network access, the use of a risky function for IP acquisition in the IP allowed list restriction, and fixed default account and password. These factors lead to security risks by making it possible to bypass network limits.

Recommendations For Apache APISIX Dashboard version 2.6, update to version 2.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the IP allowed list restriction feature until the update can be applied. Additionally, changing the default account and password can help minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

BIT-APISIX_DASHBOARD-2021-33190

CVE-2021-33190

Affected Products

Apache Apisix Dashboard

References · 7

• https://osv.dev/vulnerability/BIT-apisix_dashboard-2021-33190 · Vendor Advisory
• https://lists.apache.org/thread.html/re736aea55e8fd2478f0739c0c38a9375c4204fc1f0bd1ea687f57049%40%3Cdev.apisix.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33190 · Security Note
• https://osv.dev/vulnerability/CVE-2021-33190 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/06/08/4 · Note
• https://t.me/cvenotify/16695 · Telegram Post
• https://t.me/cvenotify/15847 · Telegram Post