apisix vulnerabilities (Bitnami)
36 vulnerabilities.
-
apisixBitnami Apache APISIX: Openid-connect introspection validation issue 5.1 Medium -
apisixBitnami Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch 6.3 Medium -
apisixBitnami Apache APISIX: Batch response aggregation can exhaust worker memory 8.2 High -
apisixBitnami Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin 2.1 Low -
apisixBitnami Apache APISIX: unauthenticated impersonation issue in saml-auth 6.4 Medium -
apisixBitnami Apache APISIX: cross-request permission pollution via static permission list mutation 5.3 Medium -
apisixBitnami Apache APISIX: data-mask may fail to redact request headers in logger output 5.7 Medium -
apisixBitnami Apache APISIX: Cross-user response poisoning in serverless plugins 7.0 High -
apisixBitnami Apache APISIX: Unauthenticated CPU-exhaustion DoS 8.7 High -
apisixBitnami Apache APISIX: ldap-auth plugin cross-subtree identity impersonation 7.0 High -
apisixBitnami Apache APISIX: attach-consumer-label does not strip client-supplied consumer-label headers 5.3 Medium -
apisixBitnami Apache APISIX: Improper authentication in cas-auth plugin 5.3 Medium -
apisixBitnami Apache APISIX: cas-auth login CSRF / session injection issue 2.1 Low -
apisixBitnami Apache APISIX: Session replay issue in hmac-auth 6.3 Medium -
apisixBitnami Apache APISIX: Cas-auth Host header influence on CAS service URL 2.1 Low -
apisixBitnami Apache APISIX: Identity spoofing issue in APISIX opa plugin 2.3 Low -
apisixBitnami Apache APISIX: Authentication bypass in jwe-decrypt 6.3 Medium -
apisixBitnami Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value 2.1 Low -
apisixBitnami Apache APISIX: Openid-connect plugin Identity Header Spoofing 5.3 Medium -
apisixBitnami Apache APISIX: authz-casdoor incorrect session sharing 5.3 Medium -
apisixBitnami Apache APISIX: wolf-rbac plugin Identity Spoofing 2.3 Low -
apisixBitnami Apache APISIX: JWT Algorithm Confusion allows authentication bypass 7.0 High -
apisixBitnami Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup 5.8 Medium -
apisixBitnami Apache APISIX: Openid-connect `tls_verify` field is disabled by default 7.5 High -
apisixBitnami Apache APISIX: Plugin tencent-cloud-cls log export uses plaintext HTTP 5.3 Medium -
apisixBitnami Apache APISIX: forward auth plugin allows header injection 9.1 Critical -
apisixBitnami Apache APISIX: basic-auth logs plaintext credentials at info level 7.5 High -
apisixBitnami Apache APISIX Java Plugin Runner: Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges 7.8 High -
apisixBitnami Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect 5.3 Medium -
apisixBitnami Apache APISIX: Forward-Auth Request Smuggling 6.3 Medium -
apisixBitnami Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations 7.5 High -
apisixBitnami apisix/jwt-auth may leak secrets in error response 7.5 High -
apisixBitnami Apache APISIX: the body_schema check in request-validation plugin can be bypassed 9.8 Critical -
apisixBitnami apisix/batch-requests plugin allows overwriting the X-REAL-IP header 9.8 Critical -
apisixBitnami Path traversal in request_uri variable 7.5 High -
apisixBitnami In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction... 6.5 Medium