https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:29:14 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-159216 EUVD-2026-159216 https://cve.radiocsirt.org/vuln/euvd-2026-159216 https://cve.radiocsirt.org/vuln/fkie_cve-2024-43397 <p>Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.</p> <p>Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-43397 https://cve.radiocsirt.org/vuln/ghsa-c6c3-h4f7-3962 <p><strong>Affected:</strong> Maven: com.ctrip.framework.apollo:apollo</p> <p>### Impact A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions.</p> <p>### Patches The issue was addressed with an input parameter check in #5192, which was released in version [2.3.0](https://github.com/apolloconfig/apollo/releases/tag/v2.3.0).</p> <p>### Workarounds To mitigate the issue without upgrading, follow the recommended practices to prevent Apollo from being exposed to the internet.</p> <p>### Credits The vulnerability was reported and reproduced by [Lakeswang](https://github.com/Lakes-bitgetsec).</p> <p>### References For any questions or comments regarding this advisory: * Open an issue in [issue](https://github.com/apolloconfig/apollo/issues) * Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)</p> <p><strong>Affected:</strong> Maven: com.ctrip.framework.apollo:apollo</p> <p>### Impact A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions.</p> <p>### Patches The issue was addressed with an input parameter check in #5192, which was released in version [2.3.0](https://github.com/apolloconfig/apollo/releases/tag/v2.3.0).</p> <p>### Workarounds To mitigate the issue without upgrading, follow the recommended practices to prevent Apollo from being exposed to the internet.</p> <p>### Credits The vulnerability was reported and reproduced by [Lakeswang](https://github.com/Lakes-bitgetsec).</p> <p>### References For any questions or comments regarding this advisory: * Open an issue in [issue](https://github.com/apolloconfig/apollo/issues) * Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)</p> https://cve.radiocsirt.org/vuln/ghsa-c6c3-h4f7-3962