Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2020-15170: Apollo Admin Service Before Version 1.7.1 Exposes Configurations to Internet
CVE-2020-15170 · published 6 years ago
Summary
If Apollo Admin Service is exposed to the internet, attackers could access and modify application configurations. This is not recommended, and users should consider isolating it from the internet. Upgrading to version 1.7.1 or later fixes this issue.
What to do
- Update ctrip com.ctrip.framework.apollo:apollo-core to version 1.7.1.
- Update ctrip apollo to version 1.7.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | ctrip | com.ctrip.framework.apollo:apollo-core |
< 1.7.1 Fix: upgrade to 1.7.1
|
| – | ctrip | apollo |
< 1.7.1 cpe:2.3:a:ctrip:apollo:*:*:*:*:*:*:*:* |
Original advisory text
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apo...
apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published10 Sep 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta