CVE-2020-13945

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Dec 7, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-139465.9In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access CVE-2020-139476.1An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp CVE-2020-139488.8While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templ CVE-2020-139497.5In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potential CVE-2020-13957.8An elevation of privilege vulnerability exists in the way that the Windows Speech Brokered API handles objects in memory, aka 'Windows Eleva CVE-2020-139507.5Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests CVE-2020-139517.5Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.CVE-2020-139528.1In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database CVE-2020-139535.3In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being ru CVE-2020-139546.1By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerab CVE-2020-139555.9HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-mi CVE-2020-139565.3Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the li