CVE-2020-13945 json
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.
published 2020-12-07 5 y ago modified 2026-09-08 2 mo ago also BIT-apisix-2020-13945 , EUVD-2020-6132
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 73.6%
- EPSS 73.6% chance of exploitation in 30 days, percentile 99.4%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
Patch / fix
- bitnami apisix 1.5.1
Timeline
- First public exploit (Metasploit exploit/multi/http/apache_apisix_api_default_token_rce)
- Published
Exploit prediction
73.58% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/apache_apisix_api_default_token_rce APISIX Admin API default access token RCE metasploit exploit, excellent rank, 2020-12-07
- Nuclei template Apache APISIX - Insufficiently Protected Credentials nuclei detection template
- packetstormsecurity.com http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | apisix | >=1.2.0, <1.5.1 |
1.5.1 |
Affected products
- Apache Software Foundation Apache APISIX
References
-
lists.apache.org
/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
mailing-list, patch, vendor-advisory, advisory
-
packetstormsecurity.com
/files/166228/Apache-APISIX-Remote-Code-Execution.html
exploit, third-party-advisory, vdb-entry, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-13945
web
Sources
- CVE List CVE-2020-13945
- NVD CVE-2020-13945
- OSV BIT-apisix-2020-13945
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.