Description
Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX.
This vulnerability allows an attacker to escalate privilege or perform an authorization bypass by sending certain values that the attach-consumer-label plugin does not sanitise correctly.
This issue affects Apache APISIX: from 3.11.0 through 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache APISIX | 3.11.0 – ≤ 3.17.0 | — |
References
- https://lists.apache.org/thread/yg9tgn699rz7kyglw82m1775do8frjr4 vendor-advisory