CVE-2020-13945

published 2020-12-07

CVE-2020-13945: In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access…

medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

EXPLOIT

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
apache	apisix	1.2 – 1.5	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—
apache_software_foundation	apache_apisix	—	—