VULNERABILITY INTELLIGENCE

CVE-2020-13945

CVSS score6.5 MEDIUM

EPSS probability72.98%

CISA KEVNot currently listed

Published2020-12-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Weakness classification

nvd@nist.gov: NVD-CWE-Other

Primary references

security@apache.org — Exploit, Third Party Advisory, VDB Entry
security@apache.org — Mailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Patch, Vendor Advisory