CVE-2020-13945

Published: Dec 7, 2020Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Affected (1)

Products: Apache: Apisix

Apache

1 product

Apisix

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Apisix	From 1.2 to 1.5

References (4)

http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E

Source: security@apache.org

Mailing ListPatchVendor Advisory

http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

Timeline

No history available yet.