CVE-2024-43397: Unauthorized Access Issue in apollo-portal
Summary
CVE-2024-43397: apollo-portal has potential unauthorized access issue. Affects com.ctrip.framework.apollo:apollo versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apollo-portal package is a component of the Apollo configuration management system. It provides a web-based interface for managing configuration namespaces. Apollo allows users to store and synchronize configurations across different environments. It is widely used in software development to manage application configurations effectively. However, a vulnerability has been discovered in the synchronization configuration feature of apollo-portal, which can lead to unauthorized access and modification of namespaces without proper permissions.
Vulnerability Detail
The vulnerability in apollo-portal arises from a flaw in the synchronization configuration feature. Attackers can exploit this flaw by crafting specific requests to bypass permission checks. By doing so, they can modify a namespace without the necessary permissions. This unauthorized access can lead to unauthorized changes in configurations, potentially compromising the integrity and security of the application. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Latest published version: 2.0.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, it is advised to follow recommended practices to prevent apollo-portal from being exposed to the internet. By restricting access to the application and implementing proper network security measures, the risk of unauthorized access can be reduced.
Conclusion
The unauthorized access issue in apollo-portal can be mitigated by upgrading to version 2.3.0 or by implementing proper network security measures. It is crucial to address this vulnerability to prevent unauthorized modifications to configuration namespaces and protect the integrity of the application.
See every vulnerability recorded for com.ctrip.framework.apollo:apollo →
FAQ
Apollo-portal is a component of the Apollo configuration management system that provides a web-based interface for managing configuration namespaces.
The vulnerability allows unauthorized access and modification of namespaces, potentially compromising the integrity and security of the application.
To fix this vulnerability, it is recommended to upgrade to version 2.3.0 of the apollo-portal package.
If upgrading is not immediately feasible, it is advised to restrict access to apollo-portal and implement proper network security measures.
The vulnerability was reported and reproduced by Lakeswang.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.ctrip.framework.apollo:apollo.
