WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Product apollo✕
Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
5matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC40.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 40.0% No exploit published 3 60.0%
Critical 0 0.0% High 0 0.0% Medium 5 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 40.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 2 / year
No exploit published: 3Mitigation candidate: 2 Medium: 5 not blocked: 5 No public exploit: 3Working exploit published: 2
20192 Mitigation candidate2 Medium2 not blocked2 Working exploit published2 20200 20210 20220 20231 No exploit published1 Medium1 not blocked1 No public exploit1 20241 No exploit published1 Medium1 not blocked1 No public exploit1 20250 20261 No exploit published1 Medium1 not blocked1 No public exploit1
20192020202120222023202420252026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-32781 Medium 2026-07-15 No exploit published No public exploit Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.
CVE-2024-43397 Medium 2024-08-20 No exploit published No public exploit Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.
CVE-2023-25569 Medium 2023-02-20 No exploit published No public exploit Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.
CVE-2019-13235 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13234 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.