CyberRota Analysis
AI-GeneratedApollo Portal versions prior to 2.5.0 are vulnerable due to inadequate verification of application and namespace permissions, allowing low-privileged users to access sensitive configuration data by exploiting a valid release ID. This could lead to unauthorized exposure of configuration information across different applications and namespaces. Organizations using Apollo for microservice configuration management should prioritize upgrading to version 2.5.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0.