CVE-2021-45232 - Vulnerability Details - OpenCVE

Description

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Published: 2021-12-27

Score: 9.8 Critical

EPSS: 85.9% High

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apache Software Foundation

Apache APISIX Dashboard

affected

Version	Status	Constraints
`2.7 and 2.7.1`	affected	—
`2.8`	affected	—
`2.9`	affected	—
`2.10`	affected	—

Configuration 1 [-]

cpe:2.3:a:apache:apisix_dashboard:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

Vendor Workaround

Implement one of the following mitigation techniques: 1. Upgrade to release 2.10.1 2. Change the default username and password, restrict the source IP to access the Apache APISIX Dashboard

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.85943.

Key SSVC decision points have not yet been added.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2021/12/27/1
https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5

History

No history.

Subscriptions

Apache Apisix Dashboard

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2021-12-27T15:06:50.000Z

Updated: 2024-08-04T04:39:20.275Z

Reserved: 2021-12-18T00:00:00.000Z

Link: CVE-2021-45232

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-12-27T15:15:07.757

Modified: 2026-06-17T04:13:13.090

Link: CVE-2021-45232

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-306
Missing Authentication for Critical Function

{"containers": {"cna": {"affected": [{"product": "Apache APISIX Dashboard", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "2.7 and 2.7.1"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}]}], "credits": [{"lang": "en", "value": "Independently discovered by ZHU Yucheng of YuanbaoTeach Security Team."}], "descriptions": [{"lang": "en", "value": "In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication."}], "metrics": [{"other": {"content": {"other": "high"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-12-27T18:06:08.000Z", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5"}, {"name": "[oss-security] 20211227 CVE-2021-45232: Apache APISIX Dashboard: security vulnerability on unauthorized access", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2021/12/27/1"}], "source": {"discovery": "UNKNOWN"}, "title": "security vulnerability on unauthorized access.", "workarounds": [{"lang": "en", "value": "Implement one of the following mitigation techniques:\n\n1. Upgrade to release 2.10.1\n\n2. Change the default username and password, restrict the source IP to access the Apache APISIX Dashboard"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2021-45232", "STATE": "PUBLIC", "TITLE": "security vulnerability on unauthorized access."}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache APISIX Dashboard", "version": {"version_data": [{"version_affected": "=", "version_name": "2.7", "version_value": "2.7 and 2.7.1"}, {"version_affected": "=", "version_name": "2.8", "version_value": "2.8"}, {"version_affected": "=", "version_name": "2.9", "version_value": "2.9"}, {"version_affected": "=", "version_name": "2.10", "version_value": "2.10"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "Independently discovered by ZHU Yucheng of YuanbaoTeach Security Team."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{"other": "high"}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-306 Missing Authentication for Critical Function"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5", "refsource": "MISC", "url": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5"}, {"name": "[oss-security] 20211227 CVE-2021-45232: Apache APISIX Dashboard: security vulnerability on unauthorized access", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2021/12/27/1"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Implement one of the following mitigation techniques:\n\n1. Upgrade to release 2.10.1\n\n2. Change the default username and password, restrict the source IP to access the Apache APISIX Dashboard"}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T04:39:20.275Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5"}, {"name": "[oss-security] 20211227 CVE-2021-45232: Apache APISIX Dashboard: security vulnerability on unauthorized access", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/12/27/1"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2021-45232", "datePublished": "2021-12-27T15:06:50.000Z", "dateReserved": "2021-12-18T00:00:00.000Z", "dateUpdated": "2024-08-04T04:39:20.275Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Apache APISIX Dashboard", "vendor": "Apache Software Foundation", "versions": [{"status": "affected", "version": "2.7 and 2.7.1"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apisix_dashboard:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB9C82EB-8D64-4783-B1E7-0ECDCC7F39A7", "versionEndExcluding": "2.10.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication."}, {"lang": "es", "value": "En Apache APISIX Dashboard versiones anteriores a 2.10.1, la API del Administrador usa dos frameworks e introduce el framework \"droplet\" sobre la base del framework \"gin\", todas las APIs y el middleware de autenticaci\u00f3n se desarrollan sobre la base del framework \"droplet\", pero algunas APIs usan directamente la interfaz del framework \"gin\" omitiendo as\u00ed la autenticaci\u00f3n"}], "id": "CVE-2021-45232", "lastModified": "2026-06-17T04:13:13.090", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-12-27T15:15:07.757", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/12/27/1"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/12/27/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@apache.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-306"}], "source": "nvd@nist.gov", "type": "Primary"}]}