CVE-2024-43397

MEDIUM EPSS 26.8%
Published Aug 20, 20241y ago · Modified Jun 17, 20261w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Aug 20, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
26.8% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-284

Affected Products 1

VendorProductVersionRange
apolloconfigapollo* <2.3.0

References 4

  • github.com https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed
    Patch
  • github.com https://github.com/apolloconfig/apollo/pull/5192
    Issue TrackingPatch
  • github.com https://github.com/apolloconfig/apollo/releases/tag/v2.3.0
    Release Notes
  • github.com https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962
    Vendor Advisory

Remediation

  • github.com https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed
    Patch
  • github.com https://github.com/apolloconfig/apollo/pull/5192
    Issue TrackingPatch