PT-2024-11900 · Apollo · Apollo

Puppy · Published 2024-01-12 · Updated 2024-08-03 · CVE-2022-4962

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apollo versions 2.0.0 through 2.0.1

Description A vulnerability was found in the Configuration Center component, affecting some unknown functionality of the file /users. This issue leads to improper authorization and can be exploited remotely. The exploit has been disclosed to the public. The existence of this vulnerability is still disputed. The maintainer notes that user data, such as user id, name, and email, are not considered sensitive.

Recommendations For Apollo versions 2.0.0 through 2.0.1, consider restricting access to the /users file in the Configuration Center component as a temporary workaround until further guidance is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2022-4962

Affected Products

Apollo

References · 8

• 🔥 https://github.com/apolloconfig/apollo/issues/4684 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4962 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4962 · Security Note
• https://t.me/cvenotify/67336 · Telegram Post
• https://vuldb.com/?ctiid.250430 · Note
• https://twitter.com/CVEnew/status/1745932393691660602 · Twitter Post
• https://t.me/cvenotify/68225 · Telegram Post
• https://vuldb.com/?id.250430 · Note