Medium severity · published Dec 7, 2020
CVE-2020-13945
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules
6.5
CVSS
73%
EPSS
No
On KEV
Description
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)73.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apisix · Apache
1.2 through 1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-13945
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-13945
Exploit
http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
Mailing List
https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E
More from Apisix
9.8
CVE-2022-24112
apisix/batch-requests plugin allows overwriting the X-REAL-IP header
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2022-25757
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as the result
9.3
CVE-2026-49871
Apache APISIX: cas-auth login CSRF / session injection issue
9.1
CVE-2026-49230
Apache APISIX: Authentication bypass in jwe-decrypt