CVE-2024-43397 json
Potential unauthorized access issue in apollo-portal
published 2024-08-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-2554 , GHSA-c6c3-h4f7-3962
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
Patch / fix
- maven com.ctrip.framework.apollo:apollo 2.3.0
- apolloconfig apollo 2.3.0
- com.ctrip.framework.apollo apollo 2.3.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.ctrip.framework.apollo:apollo | <2.3.0 |
2.3.0 |
Affected products
- apolloconfig apollo
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
github.com
/apolloconfig/apollo/pull/5192
web, issue-tracking, patch
-
github.com
/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed
web, patch
-
github.com
/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962
web, vendor-advisory
-
github.com
/apolloconfig/apollo/releases/tag/v2.3.0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-43397
advisory
-
github.com
/apolloconfig/apollo
package
Sources
- CVE List CVE-2024-43397
- GitHub Advisory GHSA-c6c3-h4f7-3962
- NVD CVE-2024-43397
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.