CVE-2024-43397

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-43397", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-08-12T18:02:04.965Z", "datePublished": "2024-08-20T14:50:01.163Z", "dateUpdated": "2024-08-20T17:18:53.095Z"}, "containers": {"cna": {"title": "Potential unauthorized access issue in apollo-portal", "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "lang": "en", "description": "CWE-284: Improper Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962"}, {"name": "https://github.com/apolloconfig/apollo/pull/5192", "tags": ["x_refsource_MISC"], "url": "https://github.com/apolloconfig/apollo/pull/5192"}, {"name": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed"}, {"name": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0"}], "affected": [{"vendor": "apolloconfig", "product": "apollo", "versions": [{"version": "< 2.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-20T14:50:01.163Z"}, "descriptions": [{"lang": "en", "value": "Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0."}], "source": {"advisory": "GHSA-c6c3-h4f7-3962", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-20T17:18:31.077423Z", "id": "CVE-2024-43397", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T17:18:53.095Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-43397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-20T17:18:31.077423Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-20T17:18:40.540Z"}}], "cna": {"title": "Potential unauthorized access issue in apollo-portal", "source": {"advisory": "GHSA-c6c3-h4f7-3962", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "apolloconfig", "product": "apollo", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "references": [{"url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962", "name": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/apolloconfig/apollo/pull/5192", "name": "https://github.com/apolloconfig/apollo/pull/5192", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed", "name": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0", "name": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284: Improper Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-20T14:50:01.163Z"}}}, "cveMetadata": {"cveId": "CVE-2024-43397", "state": "PUBLISHED", "dateUpdated": "2024-08-20T17:18:53.095Z", "dateReserved": "2024-08-12T18:02:04.965Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-08-20T14:50:01.163Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "apollo", "vendor": "apolloconfig", "versions": [{"status": "affected", "version": "< 2.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apolloconfig:apollo:*:*:*:*:*:*:*:*", "matchCriteriaId": "E006ED33-D024-4D31-BCE6-E2F8121739D6", "versionEndExcluding": "2.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0."}, {"lang": "es", "value": "Apollo es un sistema de gesti\u00f3n de configuraci\u00f3n. Existe una vulnerabilidad en la funci\u00f3n de configuraci\u00f3n de sincronizaci\u00f3n que permite a los usuarios crear solicitudes espec\u00edficas para eludir las comprobaciones de permisos. Este exploit les permite modificar un espacio de nombres sin los permisos necesarios. El problema se solucion\u00f3 con una verificaci\u00f3n de par\u00e1metros de entrada que se lanz\u00f3 en la versi\u00f3n 2.3.0."}], "id": "CVE-2024-43397", "lastModified": "2026-06-17T07:50:58.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-43397", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-08-20T17:18:31.077423Z", "version": "2.0.3"}}]}, "published": "2024-08-20T15:15:23.673", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apolloconfig/apollo/pull/5192"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/apolloconfig/apollo/releases/tag/v2.3.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}