CVE-2024-43397 Potential unauthorized access issue in apollo-portal

What is CVE-2024-43397?

CVE-2024-43397 is a medium-severity missing authorization vulnerability in apolloconfig apollo, published on 20 Aug 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

Weakness: CWE-284

Which versions are affected by CVE-2024-43397?

2 open source packages ship an affected version, including com.ctrip.framework.apollo:apollo. It affects 1 product.

Products include Apolloconfig Apollo.

How do I fix CVE-2024-43397?

Upgrade com.ctrip.framework.apollo:apollo to 2.3.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-43397 being exploited?

There is no known exploitation of CVE-2024-43397 in the wild and no public exploit code.

Other vulnerabilities in apolloconfig apollo

• CVE-2024-42662 Information disclosure in n/a High 7.5
• CVE-2023-25570 Apollo has potential access control security issue in eureka High 7.5
• CVE-2023-25569 apollo-portal has potential CSRF issue Medium 5.7
• CVE-2022-4962 Apollo Configuration Center users improper authorization Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-c6c3-h4f7-3962.