CVE-2021-45232

CVE-2021-45232: security vulnerability on unauthorized access.

Vendor Apache Software Foundation
Product Apache APISIX Dashboard
Weakness CWE-306 · Missing auth
Published December 27, 2021
Last update August 4, 2024

CVSS base score

What the vulnerability does

01Description

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Key dates

02Disclosure timeline

December 27, 2021 CVE published
August 4, 2024 Record updated