Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected
by a route-level auth plugin when a route without auth exists on the
same upstream and the upstream does not collapse encoded dot segments. This issue affects Apache APISIX: from 0.9 through 3.19.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v4.0