CVE-2021-33190
Bypass network access control
5.3
MEDIUM
CVSS 3.1
EPSS 2.7%
Description
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1
How to fix CVE-2021-33190
To remediate CVE-2021-33190, upgrade the affected package to a fixed version below.
- —upgrade to 2.6.1 or later
Is CVE-2021-33190 being exploited?
Low — EPSS is 2.7%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 2.6.0, < 2.6.1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |