In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Apache APISIX Dashboard version prior to 2.10.1 suffers from a vulnerability allowing a remote attacker to bypass authentication and access sensitive resources via a specially forged request.

The version of Apache APISIX Dashboard installed on the remote host is prior to 2.10.1. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated, remote attacker could exploit this to bypass authentication.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apache APISIX Dashboard installed on the remote host is prior to 2.10.1. It is, therefore, affected by an authentication bypass vulnerability. An unauthenticated, remote attacker could exploit this to bypass authentication.

ID	Name	Product	Family	Severity
114499	Apache APISIX Dashboard < 2.10.1 Authentication Bypass	Web App Scanning	Component Vulnerability	critical
160299	Apache APISIX Dashboard < 2.10.1 Authentication Bypass	Nessus	Misc.	critical
160297	Apache APISIX Dashboard < 2.10.1 Authentication Bypass (Direct Check)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2021-45232

critical

Tenable Plugins

critical

critical

critical