{"id":"CVE-2020-15170","aliases":["EUVD-2020-1441","GHSA-xpmx-h7xq-xffh"],"status":"published","title":"Missing access control in apollo-adminservice","description":"apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01315,"percentile":0.70997,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2020-09-10T18:40:14Z","modified":"2026-10-20T10:49:44Z","fixes":[{"ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo-core","fixed_in":["1.7.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.2","1.7.0"]}],"products":[{"vendor":"ctrip","product":"apollo"},{"vendor":"ctripcorp","product":"apollo"},{"vendor":"lambertgroup","product":"apollo"}],"references":[{"url":"https://github.com/ctripcorp/apollo/security/advisories/GHSA-xpmx-h7xq-xffh","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/ctripcorp/apollo/pull/3233/commits/ae9ba6cfd32ed80469f162e5e3583e2477862ddf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15170","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xpmx-h7xq-xffh"},{"url":"https://github.com/ctripcorp/apollo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-15170","title":"Missing access control in apollo-adminservice","description":"apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.","status":"published","published":"2020-09-10T18:40:14Z","modified":"2024-08-04T13:08:22.406Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-1441","description":"apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.","status":"published","published":"2020-09-10T18:40:14Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-xpmx-h7xq-xffh","title":"Potential access control security issue in apollo-adminservice","description":"### Impact\nIf users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.\n\n### Patches\nAccess control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.\n\n### Credits\n[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.\n\n### References\n[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an [issue](https://github.com/ctripcorp/apollo/issues)\n* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)","status":"published","published":"2020-10-02T16:33:41Z","modified":"2023-02-01T05:04:54Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2020-15170","description":"apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.","status":"published","published":"2020-09-10T19:15:13.583Z","modified":"2026-06-17T02:56:11.417Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-15170","description":"apollo-adminservice before version 1.7.1 does not implement access controls. If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have access control built-in. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations. To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.","status":"published","published":"2020-09-10T19:15:13.583Z","modified":"2026-10-20T10:49:44.81267214Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-xpmx-h7xq-xffh","title":"Potential access control security issue in apollo-adminservice","description":"### Impact\nIf users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.\n\n### Patches\nAccess control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.\n\n### Credits\n[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.\n\n### References\n[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an [issue](https://github.com/ctripcorp/apollo/issues)\n* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)","status":"published","published":"2020-10-02T16:33:41Z","modified":"2026-09-10T03:48:35.479433259Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}