CVE-2021-45232

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
Apache Software FoundationApache APISIX Dashboard2.7 and 2.7.1; 2.8; 2.9; 2.10

References

Timeline

Published
Dec 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-452529.8Multiple SQL injection vulnerabilities are found on Simple Forum-Discussion System 1.0 For example on three applications which are manage_toCVE-2021-452539.8The id parameter in view_storage.php from Simple Cold Storage Management System 1.0 appears to be vulnerable to SQL injection attacks. A payCVE-2021-452559.8The email parameter from ajax.php of Video Sharing Website 1.0 appears to be vulnerable to SQL injection attacks. A payload injects a SQL suCVE-2021-452565.5A Null Pointer Dereference vulnerability existfs in nasm 2.16rc0 via asm/preproc.c.CVE-2021-452575.5An infinite loop vulnerability exists in nasm 2.16rc0 via the gpaste_tokens function.CVE-2021-452585.5A stack overflow vulnerability exists in gpac 1.1.0 via the gf_bifs_dec_proto_list function, which causes a segmentation fault and applicatiCVE-2021-452595.5An Invalid pointer reference vulnerability exists in gpac 1.1.0 via the gf_svg_node_del function, which causes a segmentation fault and applCVE-2021-452605.5A null pointer dereference vulnerability exists in gpac 1.1.0 in the lsr_read_id.part function, which causes a segmentation fault and applicCVE-2021-452615.5An Invalid Pointer vulnerability exists in GNU patch 2.7 via the another_hunk function, which causes a Denial of Service.CVE-2021-452625.5An invalid free vulnerability exists in gpac 1.1.0 via the gf_sg_command_del function, which causes a segmentation fault and application craCVE-2021-452635.5An invalid free vulnerability exists in gpac 1.1.0 via the gf_svg_delete_attribute_value function, which causes a segmentation fault and appCVE-2021-452667.5A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault an
CVE-2021-45232: Critical severity, CVSS 9.8 | Vulnix