CVE-2021-45232

    Dashboard / Vulnerabilities / CVE-2021-45232

    CVE-2021-45232

    Published: 27 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

    References: http://www.openwall.com/lists/oss-security/2021/12/27/1, https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2094ced53058943ca6ce31b813129a6fefed57c0

    Affected versions

    v2.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-45232 | CVE-DB