CVE-2023-25569 apollo-portal has potential CSRF issue

What is CVE-2023-25569?

CVE-2023-25569 is a medium-severity vulnerability in apolloconfig apollo, published on 20 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

Weakness: CWE-352

Which versions are affected by CVE-2023-25569?

2 open source packages ship an affected version, including com.ctrip.framework.apollo:apollo. It affects 1 product.

Products include Apolloconfig Apollo.

How do I fix CVE-2023-25569?

Upgrade com.ctrip.framework.apollo:apollo to 2.1.0 or later.

Is CVE-2023-25569 being exploited?

There is no known exploitation of CVE-2023-25569 in the wild and no public exploit code.

Other vulnerabilities in apolloconfig apollo

• CVE-2024-42662 Information disclosure in n/a High 7.5
• CVE-2023-25570 Apollo has potential access control security issue in eureka High 7.5
• CVE-2024-43397 Potential unauthorized access issue in apollo-portal Medium 4.3
• CVE-2022-4962 Apollo Configuration Center users improper authorization Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fmxq-v8mg-qh25.