Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache APISIX

34 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2022-24112 Exploited Public exploit EPSS 96%

    apisix/batch-requests plugin allows overwriting the X-REAL-IP header

    An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of A…

    Apache Software Foundation Apache APISIX
    KEV Aug 25, 2022