Apache APISIX Dashboard 2.6 < 2.6.1 Authentication Bypass

medium Nessus Plugin ID 161978


An application installed on the remote host is missing a vendor-supplied update.


The version of Apache APISIX Dashboard installed on the remote host is 2.6 prior to 2.6.1. It is, therefore, affected by an authentication bypass vulnerability. In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed. Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Upgrade to Apache APISIX Dashboard version 2.6.1 or later.

See Also



Plugin Details

Severity: Medium

ID: 161978

File Name: apache_apisix_dashboard_2_6_1.nasl

Version: 1.2

Type: remote

Family: Misc.

Published: 6/9/2022

Updated: 6/13/2022

Risk Information


Risk Factor: Low

Score: 1.4


Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSS Score Source: CVE-2021-33190


Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:2.3:a:apache:apisix_dashboard:*:*:*:*:*:*:*:*

Required KB Items: installed_sw/Apache APISIX Dashboard

Exploit Ease: No known exploits are available

Patch Publication Date: 5/27/2021

Vulnerability Publication Date: 6/8/2021

Reference Information

CVE: CVE-2021-33190