Description
Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| apolloconfig | apollo | < 2.3.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.ctrip.framework.apollo:apollo | < 2.3.0 | 2.3.0 | GHSA-c6c3-h4f7-3962 |