deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-32846
Published: 2023-02-17
Description: HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107, function `pci_vtsock_proc_tx` in `virtio-sock` can lead to to uninitialized memory use. In this situation, there is a check for the return value to be less or equal to `VTSOCK_MAXSEGS`, but that check is not sufficient because the function can return `-1` if it finds an error it cannot recover from. Moreover, the negative return value will be used by `iovec_pull` in a while condition that can further lead to more corruption because the function is not designed to handle a negative `iov_len`. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit af5eba2360a7351c08dfd9767d9be863a50ebaba.
CVSS Score: 7.7 (HIGH)
CWE: CWE-908, CWE-754
References: https://github.com/moby/hyperkit/commit/af5eba2360a7351c08dfd9767d9be863a50ebaba; https://github.com/moby/hyperkit/pull/313; https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit/
CVE: CVE-2023-0901
Published: 2023-02-18
Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/pixelfed/pixelfed/commit/5b5f5bc38ca9ba39d0b7dacc3813fb899f71ba57; https://huntr.dev/bounties/0327b1b2-6e7c-4154-a307-15f236571010; https://github.com/pixelfed/pixelfed/commit/5b5f5bc38ca9ba39d0b7dacc3813fb899f71ba57
CVE: CVE-2022-40348
Published: 2023-02-18
Description: Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allows attackers to execute arbitrary code.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://code-projects.org/intern-record-system-in-php-with-source-code/; https://download-media.code-projects.org/2020/03/Intern_Record_System_In_PHP_With_Source_Code.zip; https://github.com/h4md153v63n/CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated
CVE: CVE-2023-0902
Published: 2023-02-18
Description: A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221451.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Simple%20Food%20Ordering%20System%20-%20Authenticated%20Reflected%20XSS.md; https://vuldb.com/?ctiid.221451; https://vuldb.com/?id.221451
CVE: CVE-2023-0903
Published: 2023-02-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file edit-task.php. The manipulation of the argument task_id leads to sql injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221452.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20SQL%20Injection.md; https://vuldb.com/?ctiid.221452; https://vuldb.com/?id.221452
CVE: CVE-2023-0904
Published: 2023-02-18
Description: A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221453 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20SQL%20Injection%20-%202.md; https://vuldb.com/?ctiid.221453; https://vuldb.com/?id.221453
CVE: CVE-2023-0905
Published: 2023-02-18
Description: A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221454 is the identifier assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-287
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Employee%20Task%20Management%20System%20-%20Broken%20Authentication.md; https://vuldb.com/?ctiid.221454; https://vuldb.com/?id.221454
CVE: CVE-2023-0906
Published: 2023-02-18
Description: A vulnerability classified as critical was found in SourceCodester Online Pizza Ordering System 1.0. Affected by this vulnerability is the function delete_category of the file ajax.php of the component POST Parameter Handler. The manipulation leads to missing authentication. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-221455.
CVSS Score: 7.3 (HIGH)
CWE: CWE-306
References: https://vuldb.com/?ctiid.221455; https://vuldb.com/?id.221455; https://vuldb.com/?ctiid.221455
CVE: CVE-2023-0907
Published: 2023-02-18
Description: A vulnerability, which was classified as problematic, has been found in Filseclab Twister Antivirus 8.17. Affected by this issue is the function 0x220017 in the library ffsmon.sys of the component IoControlCode Handler. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-221456.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-404
References: https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-0907; https://vuldb.com/?ctiid.221456; https://vuldb.com/?id.221456
CVE: CVE-2023-0908
Published: 2023-02-18
Description: A vulnerability, which was classified as problematic, was found in Xoslab Easy File Locker 2.2.0.184. This affects the function MessageNotifyCallback in the library xlkfs.sys. The manipulation leads to denial of service. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-221457 was assigned to this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404, CWE-404
References: https://github.com/zeze-zeze/WindowsKernelVuln/tree/master/CVE-2023-0908; https://vuldb.com/?ctiid.221457; https://vuldb.com/?id.221457
CVE: CVE-2023-0909
Published: 2023-02-18
Description: A vulnerability, which was classified as problematic, was found in cxasm notepad-- 1.22. This affects an unknown part of the component Directory Comparison Handler. The manipulation leads to denial of service. The attack needs to be approached locally. The associated identifier of this vulnerability is VDB-221475.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-404
References: https://gitee.com/cxasm/notepad--/issues/I6C80Z; https://vuldb.com/?ctiid.221475; https://vuldb.com/?id.221475
CVE: CVE-2023-0910
Published: 2023-02-18
Description: A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. This vulnerability affects unknown code of the file view_prod.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-221476.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://vuldb.com/?ctiid.221476; https://vuldb.com/?id.221476; https://vuldb.com/?ctiid.221476
CVE: CVE-2023-0912
Published: 2023-02-18
Description: A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221481 was assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20SQL%20Injection%20-%201.md; https://vuldb.com/?ctiid.221481; https://vuldb.com/?id.221481
CVE: CVE-2023-0913
Published: 2023-02-18
Description: A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221482 is the identifier assigned to this vulnerability.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20SQL%20Injection%20-%202.md; https://vuldb.com/?ctiid.221482; https://vuldb.com/?id.221482
CVE: CVE-2023-0914
Published: 2023-02-19
Description: Improper Authorization in GitHub repository pixelfed/pixelfed prior to 0.11.4.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285
References: https://github.com/pixelfed/pixelfed/commit/ef56f92c3d77e9bafaa70c08b7c04d5a61b8d454; https://huntr.dev/bounties/54d5fd76-e038-4eda-9e03-d5e95e09c0ec; https://github.com/pixelfed/pixelfed/commit/ef56f92c3d77e9bafaa70c08b7c04d5a61b8d454
CVE: CVE-2023-0915
Published: 2023-02-19
Description: A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function of the file /adms/admin/?page=user/manage_user. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221490 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20SQL%20Injection%20-%203.md; https://vuldb.com/?ctiid.221490; https://vuldb.com/?id.221490
CVE: CVE-2023-0916
Published: 2023-02-19
Description: A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221491.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/navaidzansari/CVE_Demo/blob/main/2023/Auto%20Dealer%20Management%20System%20-%20Broken%20Access%20Control.md; https://vuldb.com/?ctiid.221491; https://vuldb.com/?id.221491
CVE: CVE-2023-0917
Published: 2023-02-19
Description: A vulnerability, which was classified as critical, was found in SourceCodester Simple Customer Relationship Management System 1.0. This affects an unknown part of the file /php-scrm/login.php. The manipulation of the argument Password leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221493 was assigned to this vulnerability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-89
References: https://github.com/awans2023/CVE/blob/main/README1.md; https://vuldb.com/?ctiid.221493; https://vuldb.com/?id.221493
CVE: CVE-2023-0918
Published: 2023-02-19
Description: A vulnerability has been found in codeprojects Pharmacy Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file add.php of the component Avatar Image Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-221494 is the identifier assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-434
References: https://blog.0xgabe.com/?p=71; https://vuldb.com/?ctiid.221494; https://vuldb.com/?id.221494
CVE: CVE-2023-0919
Published: 2023-02-19
Description: Missing Authentication for Critical Function in GitHub repository kareadita/kavita prior to 0.7.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-306
References: https://github.com/Kareadita/Kavita/pull/1748/commits/6648b79e1b2f92449d5816d0722b7a3d72f259d5; https://huntr.dev/bounties/3c514923-473f-4c50-ae0d-d002a41fe70f; https://github.com/Kareadita/Kavita/pull/1748/commits/6648b79e1b2f92449d5816d0722b7a3d72f259d5
CVE: CVE-2012-10007
Published: 2023-02-19
Description: A vulnerability was found in madgicweb BuddyStream Plugin up to 3.2.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file ShareBox.php. The manipulation of the argument content/link/shares leads to cross site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue. The patch is named 7d5b9a89a27711aad76fd55ab4cc4185b545a1d0. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221479.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/madgicweb/buddystream/commit/7d5b9a89a27711aad76fd55ab4cc4185b545a1d0; https://github.com/madgicweb/buddystream/releases/tag/3.2.8; https://vuldb.com/?ctiid.221479
CVE: CVE-2014-125087
Published: 2023-02-19
Description: A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: https://github.com/jmurty/java-xmlbuilder/commit/e6fddca201790abab4f2c274341c0bb8835c3e73; https://github.com/jmurty/java-xmlbuilder/issues/6; https://github.com/jmurty/java-xmlbuilder/releases/tag/v1.2
CVE: CVE-2016-15024
Published: 2023-02-19
Description: A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be difficult. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 3332c5ba9ec3014ddc74e2147190a050eee97bc0. It is recommended to apply a patch to fix this issue. VDB-221478 is the identifier assigned to this vulnerability.
CVSS Score: 2.5 (LOW)
CWE: CWE-404
References: https://github.com/doomsider/shadow/commit/3332c5ba9ec3014ddc74e2147190a050eee97bc0; https://vuldb.com/?ctiid.221478; https://vuldb.com/?id.221478
CVE: CVE-2023-26081
Published: 2023-02-20
Description: In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-668, CWE-668
References: https://github.com/google/security-research/security/advisories/GHSA-mhhf-w9xw-pp9x; https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1275; https://lists.debian.org/debian-lts-announce/2023/05/msg00015.html
CVE: CVE-2022-48328
Published: 2023-02-20
Description: app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://github.com/MISP/MISP/commit/1edbc2569989f844799261a5f90edfa433d7dbcc; https://github.com/MISP/MISP/commit/206f540f0275af2dd2a86275abc199df41e72a21; https://github.com/MISP/MISP/compare/v2.4.166...v2.4.167
CVE: CVE-2022-48329
Published: 2023-02-20
Description: MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php, and app/Plugin/Assets/models/behaviors/LogableBehavior.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755, CWE-755
References: https://github.com/MISP/MISP/commit/a73c1c461bc6f8a048eae92b5e99823afd892d1e; https://github.com/MISP/MISP/commit/afbe08d256d609eee5195c5b0003cfb723ae7af1; https://github.com/MISP/MISP/compare/v2.4.165...v2.4.166
CVE: CVE-2023-26092
Published: 2023-02-20
Description: Liima before 1.17.28 allows server-side template injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-917, CWE-917
References: https://github.com/liimaorg/liima/blob/master/release-changelog.md; https://github.com/liimaorg/liima/pull/678; https://github.com/liimaorg/liima/blob/master/release-changelog.md
CVE: CVE-2023-26093
Published: 2023-02-20
Description: Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://github.com/liimaorg/liima/blob/master/release-changelog.md; https://github.com/liimaorg/liima/pull/663; https://github.com/liimaorg/liima/blob/master/release-changelog.md
CVE: CVE-2012-10008
Published: 2023-02-20
Description: A vulnerability, which was classified as critical, has been found in uakfdotb oneapp. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 5413ac804f1b09f9decc46a6c37b08352c49669c. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221483.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/uakfdotb/oneapp/commit/5413ac804f1b09f9decc46a6c37b08352c49669c; https://vuldb.com/?ctiid.221483; https://vuldb.com/?id.221483
CVE: CVE-2013-10019
Published: 2023-02-20
Description: A vulnerability was found in OCLC-Research OAICat 1.5.61. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The attack may be initiated remotely. Upgrading to version 1.5.62 is able to address this issue. The identifier of the patch is 6cc65501869fa663bcd24a70b63f41f5cfe6b3e1. It is recommended to upgrade the affected component. The identifier VDB-221489 was assigned to this vulnerability.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://code.google.com/archive/p/oaicat/issues/7; https://github.com/OCLC-Research/oaicat/commit/6cc65501869fa663bcd24a70b63f41f5cfe6b3e1; https://oaicat.googlecode.com/files/oaicat-1.5.62.tar.gz
CVE: CVE-2014-125088
Published: 2023-02-20
Description: A vulnerability was found in qt-users-jp silk 0.0.1. It has been declared as problematic. This vulnerability affects unknown code of the file contents/root/examples/header.qml. The manipulation of the argument model.key/model.value leads to cross site scripting. The attack can be initiated remotely. The name of the patch is bbc5d6eeea800025ef29edda3fd3c57836239eae. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221488.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/qt-users-jp/silk/commit/bbc5d6eeea800025ef29edda3fd3c57836239eae; https://vuldb.com/?ctiid.221488; https://vuldb.com/?id.221488
CVE: CVE-2015-10080
Published: 2023-02-20
Description: A vulnerability was found in NREL api-umbrella-web 0.7.1. It has been classified as problematic. This affects an unknown part of the component Admin Data Table Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 0.8.0 is able to address this issue. The patch is named f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-221487.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/NREL/api-umbrella-web/commit/f53a9fb87e10c457f0f3dd4f2af24d3b2f21b3ca; https://github.com/NREL/api-umbrella-web/releases/tag/v0.8.0; https://vuldb.com/?ctiid.221487
CVE: CVE-2016-15025
Published: 2023-02-20
Description: A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/_app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is c17092fd4103143a9ddab93c8983ace8bf174396. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-221484.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://github.com/johnpapa/generator-hottowel/commit/c17092fd4103143a9ddab93c8983ace8bf174396; https://github.com/johnpapa/generator-hottowel/pull/174; https://vuldb.com/?ctiid.221484
CVE: CVE-2016-15026
Published: 2023-02-20
Description: A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The patch is identified as 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-611
References: https://github.com/3breadt/dd-plist/commit/8c954e8d9f6f6863729e50105a8abf3f87fff74c; https://github.com/3breadt/dd-plist/pull/26; https://github.com/3breadt/dd-plist/releases/tag/dd-plist-1.18
CVE: CVE-2023-24998
Published: 2023-02-20
Description: Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads.




Note that, like all of the file upload limits, the
          new configuration option (FileUploadBase#setFileCountMax) is not
          enabled by default and must be explicitly configured.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: http://www.openwall.com/lists/oss-security/2023/05/22/1; https://lists.apache.org/thread/4xl4l09mhwg4vgsk7dxqogcjrobrrdoy; https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
CVE: CVE-2023-25569
Published: 2023-02-20
Description: Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

CVSS Score: 5.7 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750; https://github.com/apolloconfig/apollo/pull/4664; https://github.com/apolloconfig/apollo/releases/tag/v2.1.0
CVE: CVE-2023-25570
Published: 2023-02-20
Description: Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice. Login authentication for eureka was added in version 2.1.0. As a workaround, avoid exposing apollo-configservice to the internet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://github.com/apolloconfig/apollo/commit/7df79bf8df6960433ed4ff782a54e3dfc74632bd; https://github.com/apolloconfig/apollo/pull/4663; https://github.com/apolloconfig/apollo/releases/tag/v2.1.0