Vulnerabilities > CVE-2024-43397 - Unspecified vulnerability in Apolloconfig Apollo

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

apolloconfig

NVD

Published: 2024-08-20

Updated: 2024-08-26

Summary

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

Vulnerable Configurations

Part	Description	Count
Application	Apolloconfig Apolloconfig Apollo 0.4.0 Apolloconfig Apollo 0.5.0 Apolloconfig Apollo 0.6.0 Apolloconfig Apollo 0.6.2 Apolloconfig Apollo 0.6.3 Apolloconfig Apollo 0.7.0 Apolloconfig Apollo 0.8.0 Apolloconfig Apollo 0.9.0 Apolloconfig Apollo 0.9.1 Apolloconfig Apollo 0.10.0 Apolloconfig Apollo 0.10.1 Apolloconfig Apollo 0.10.2 Apolloconfig Apollo 0.11.0 Apolloconfig Apollo 1.0.0 Apolloconfig Apollo 1.1.0 Apolloconfig Apollo 1.1.1 Apolloconfig Apollo 1.1.2 Apolloconfig Apollo 1.2.0 Apolloconfig Apollo 1.3.0 Apolloconfig Apollo 1.4.0 Apolloconfig Apollo 1.5.0 Apolloconfig Apollo 1.5.1 Apolloconfig Apollo 1.6.0 Apolloconfig Apollo 1.6.1 Apolloconfig Apollo 1.6.2 Apolloconfig Apollo 1.7.0 Apolloconfig Apollo 1.7.1 Apolloconfig Apollo 1.7.2 Apolloconfig Apollo 1.8.0 Apolloconfig Apollo 1.8.1 Apolloconfig Apollo 1.8.2 Apolloconfig Apollo 1.9.0 Apolloconfig Apollo 1.9.1 Apolloconfig Apollo 1.9.2 Apolloconfig Apollo 2.0.0 Apolloconfig Apollo 2.0.1 Apolloconfig Apollo 2.1.0	38

Summary

Vulnerable Configurations

References