Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-25569 Details

Description

Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.

Metrics

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750 CVEPatch
https://github.com/apolloconfig/apollo/pull/4664 CVEIssue TrackingPatch
https://github.com/apolloconfig/apollo/releases/tag/v2.1.0 CVERelease Notes
https://github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25 CVEThird Party Advisory
https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related CVEProduct

see all 10 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-352Cross-Site Request Forgery (CSRF)[email protected]
CWE-352Cross-Site Request Forgery (CSRF)[email protected]

Affected Products

ProductVersions
apolloconfig apollo
< 2.1.0

CPE

  • cpe:2.3:a:apolloconfig:apollo:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

6 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-25569
NVD Published Date:
Feb 20, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-25569 Details - Not Deferred