CVE-2023-25569: CSRF vulnerability in apollo-portal
Summary
CVE-2023-25569: apollo-portal has potential CSRF issue. Affects com.ctrip.framework.apollo:apollo versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apollo-portal package is a component of the Apollo configuration management system. It provides a web-based portal for managing configurations. The package is commonly used in Maven projects. The vulnerability identified as CVE-2023-25569 is a Cross-Site Request Forgery (CSRF) issue that affects the apollo-portal package.
Vulnerability Detail
The CSRF vulnerability in apollo-portal allows a low-privileged user to create a malicious web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the admin. This can lead to unauthorized privilege escalation and potential misuse of the system. The vulnerability has a CVSS score of 5.7, indicating a moderate severity level.
How To Fix
Latest published version: 2.0.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately feasible, users can mitigate the potential issue by avoiding visiting unknown source pages. By refraining from accessing untrusted web pages, the risk of falling victim to CSRF attacks can be reduced.
Conclusion
The CSRF vulnerability in apollo-portal poses a moderate risk to the security of the application. Upgrading to version 2.1.0 or applying the recommended workaround will help mitigate the issue. For further support and assistance in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
The vulnerability allows a low-privileged user to perform unauthorized privilege escalation by assigning new roles to themselves without confirmation from the admin.
The vulnerability can be fixed by upgrading to version 2.1.0 of the apollo-portal package, which includes a patch for the CSRF issue.
If immediate upgrading is not possible, users can mitigate the risk by avoiding visiting unknown source pages.
The CVSS score of this vulnerability is 5.7, indicating a moderate severity level.
For more information, you can refer to the Apollo Security Guidance documentation or reach out to the Apollo team through their GitHub repository or email.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
