Critical Apollo CVEs

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 2 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q4 171 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 191 No exploit published1 Critical1 not blocked1 No public exploit1

Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2019-10686	Critical	2019-04-01	No exploit published	No public exploit	An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.
CVE-2014-3579	Critical	2017-10-27	Protected by Waratek	No public exploit	XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2019-10686

Critical

2019-04-01

No exploit published

No public exploit

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

CVE-2014-3579

Critical

2017-10-27

Protected by Waratek

No public exploit

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.