GitHub Advisoryadvisory · Maven
GHSA-fmxq-v8mg-qh25 apollo-portal has potential CSRF issue
MEDIUM
Official page ↗
- Aliases
- CVE-2023-25569
- Ecosystem
- Maven
- Packages
- com.ctrip.framework.apollo:apollo
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- Weaknesses
- CWE-352
- Reviewed
- 2023-02-22
Affected packages
• Maven com.ctrip.framework.apollo:apollo: < 2.1.0 → fixed in 2.1.0
Description
Impact
A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin.
Patches
Cookie SameSite strategy was set to Lax in #4664 and was released in v2.1.0.
Workarounds
To fix the potential issue without upgrading, simply follow the advice that does not visit unknown source pages.
References
Apollo Security Guidence
For more information
If you have any questions or comments about this advisory:
• Open an issue in issue
• Email us at [email protected]
Related
Alias · CVE (1)
- CVE-2023-25569 Apollo is a configuration management system. vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-25569 advisory
- https://github.com/apolloconfig/apollo/pull/4664 web
- https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750 web
- https://github.com/apolloconfig/apollo package
- https://github.com/apolloconfig/apollo/releases/tag/v2.1.0 web
- https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related web