Vulnerabilities
5 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-42662 +1 in the same advisory: …43397 | An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. An issue in apollocongif apollo v.2.2.0 allows a remote attacker to obtain sensitive information via a crafted request. NVD description · AI analysis pending | 7.5 group max | <1% |
| — | ||
| CVE-2022-4962 | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive. NVD description · AI analysis pending | 4.3 | <1% | PoC |
| — | |
| CVE-2023-25570 +1 in the same advisory: …25569 | Apollo is a configuration management system. Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservice to the internet, which is not recommended. This is because there is no authentication feature enabled for the built-in eureka service. Malicious hackers may access eureka directly to mock apollo-configservice and apollo-adminservice. Login authentication for eureka was added in version 2.1.0. As a workaround, avoid exposing apollo-configservice to the internet. NVD description · AI analysis pending | 7.5 group max | <1% |
| — |