{"id":"CVE-2023-25569","aliases":["EUVD-2023-0700","GHSA-fmxq-v8mg-qh25"],"status":"published","title":"apollo-portal has potential CSRF issue","description":"Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00351,"percentile":0.29066,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2023-02-20T15:12:35Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo","fixed_in":["2.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.ctrip.framework.apollo:apollo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}],"versions":["1.0.0","1.1.0","1.1.1","1.1.2","1.2.0","1.3.0","1.4.0","1.5.0","1.5.1","1.6.0","1.6.2","1.7.0","1.8.0","1.9.0","1.9.1","1.9.2","2.0.0","2.0.0-RC1","2.0.1"]}],"products":[{"vendor":"apolloconfig","product":"apollo"},{"vendor":"lambertgroup","product":"apollo"}],"references":[{"url":"https://github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/apolloconfig/apollo/pull/4664","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/apolloconfig/apollo/releases/tag/v2.1.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web"]},{"url":"https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25569","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fmxq-v8mg-qh25"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25569.json","tags":["advisory"]},{"url":"https://github.com/apolloconfig/apollo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-25569","title":"apollo-portal has potential CSRF issue","description":"Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.\n","status":"published","published":"2023-02-20T15:12:35.031Z","modified":"2025-03-10T21:08:07.214Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-0700","description":"Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.\n","status":"published","published":"2023-02-20T15:12:35Z","modified":"2025-03-10T21:08:07Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:09.197707Z"}],"ghsa":[{"id":"GHSA-fmxq-v8mg-qh25","title":"apollo-portal has potential CSRF issue","description":"### Impact\nA low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin.\n\n### Patches\nCookie SameSite strategy was set to Lax in #4664 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that does not visit unknown source pages.\n\n### References\n[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)\n","status":"published","published":"2023-02-22T21:58:27Z","modified":"2023-02-22T21:58:28Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2023-25569","description":"Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.\n","status":"published","published":"2023-02-20T16:15:10.503Z","modified":"2026-06-17T05:41:30.747Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:07:47.623983Z"}],"osv":[{"id":"CVE-2023-25569","title":"apollo-portal has potential CSRF issue","description":"Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.\n","status":"published","published":"2023-02-20T15:12:35.031Z","modified":"2026-10-28T02:30:33.605965683Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-fmxq-v8mg-qh25","title":"apollo-portal has potential CSRF issue","description":"### Impact\nA low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin.\n\n### Patches\nCookie SameSite strategy was set to Lax in #4664 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).\n\n### Workarounds\nTo fix the potential issue without upgrading, simply follow the advice that does not visit unknown source pages.\n\n### References\n[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)\n","status":"published","published":"2023-02-22T21:58:27Z","modified":"2023-11-08T04:11:52.171959Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:46.760785Z"}]}}