{"id":"CVE-2024-43397","aliases":["GHSA-c6c3-h4f7-3962"],"url":"https://o3.security/vulnerability/CVE-2024-43397","summary":"Potential unauthorized access issue in apollo-portal","details":"### Impact\nA vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions.\n\n### Patches\nThe issue was addressed with an input parameter check in #5192, which was released in version [2.3.0](https://github.com/apolloconfig/apollo/releases/tag/v2.3.0).\n\n### Workarounds\nTo mitigate the issue without upgrading, follow the recommended practices to prevent Apollo from being exposed to the internet.\n\n### Credits\nThe vulnerability was reported and reproduced by [Lakeswang](https://github.com/Lakes-bitgetsec).\n\n### References\nFor any questions or comments regarding this advisory:\n* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)\n* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)","published":"2024-08-20T14:50:01.163Z","modified":"2026-08-12T15:15:29.239247Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.ctrip.framework.apollo:apollo","fixedVersion":"2.3.0"}],"fix":{"url":"https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed","label":"apolloconfig/apollo@f55b419"},"references":[{"type":"WEB","url":"https://github.com/apolloconfig/apollo/releases/tag/v2.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43397.json"},{"type":"ADVISORY","url":"https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43397"},{"type":"FIX","url":"https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed"},{"type":"FIX","url":"https://github.com/apolloconfig/apollo/pull/5192"},{"type":"PACKAGE","url":"https://github.com/apolloconfig/apollo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:15:29.239247Z"}}