CVE-2024-43397: Potential unauthorized access issue in apollo-portal

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-20 · updated 2026-06-17
Weakness: CWE-284

Description

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

Affected products

apolloconfig apollo: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: apolloconfig apollo 2.3.0. Check the vendor advisory for mitigations.

References

https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97ed
https://github.com/apolloconfig/apollo/pull/5192
https://github.com/apolloconfig/apollo/releases/tag/v2.3.0
https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962

Get alerted when CVE-2024-43397 or the next vulnerability affects your stack