com.ctrip.framework.apollo:apollo (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package com.ctrip.framework.apollo:apollo, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2019-10686 — CVSS 10.0 (critical): An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or…
• CVE-2023-25570 — CVSS 7.5 (high): Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose…
• CVE-2023-25569 — CVSS 5.7 (medium): Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an…
• CVE-2024-43397 — CVSS 4.3 (medium): Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft…