CVE-2020-13945

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules

published December 7, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
73%
Percentile
99.5
In the wild
Unconfirmed
What it is

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.72976 · 99.5th percentile
Published
2020-12-07T19:04Z
EPSS history
Timeline
  • 07 DEC 19:04Z
    In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
    cvelistv5