Unrated severityNVD Advisory· Published Dec 7, 2020· Updated Aug 4, 2024

CVE-2020-13945

Description

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Apache/Apisixllm-fuzzy
Range: 1.2, 1.3, 1.4, 1.5
osv-coords
pkg:bitnami/apisix
Range: >= 1.2.0, < 1.5.1
Apache/Apachecpe-rescue
Range: 1.2

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.htmlmitrex_refsource_MISC
lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3Emitrex_refsource_CONFIRM

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.058
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000