CVE-2023-25569: apollo-portal has potential CSRF issue
Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.
References
- github.com/advisories/GHSA-fmxq-v8mg-qh25
- github.com/apolloconfig/apollo/commit/00d968a7229f809b0d8ed0532e8c01a6c2b7c750
- github.com/apolloconfig/apollo/pull/4664
- github.com/apolloconfig/apollo/releases/tag/v2.1.0
- github.com/apolloconfig/apollo/security/advisories/GHSA-fmxq-v8mg-qh25
- nvd.nist.gov/vuln/detail/CVE-2023-25569
- www.apolloconfig.com/
Code Behaviors & Features
Detect and mitigate CVE-2023-25569 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →