CVE-2024-43397

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

• CWE-284

• https://github.com/apolloconfig/apollo/commit/f55b419145bf9d4f2f51dd4cd45108229e8d97edPatch
• https://github.com/apolloconfig/apollo/pull/5192Issue Tracking, Patch
• https://github.com/apolloconfig/apollo/releases/tag/v2.3.0Release Notes
• https://github.com/apolloconfig/apollo/security/advisories/GHSA-c6c3-h4f7-3962Vendor Advisory

Published

Aug 20, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43391A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43392A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43393A low privileged remote attacker can perform configuration c…8.1
• CVE-2024-43394Server-Side Request Forgery (SSRF) in Apache HTTP Server on …7.5
• CVE-2024-43395CraftOS-PC 2 is a rewrite of the desktop port of CraftOS fro…8.2
• CVE-2024-43396Khoj is an application that creates personal AI agents. The …5.4
• CVE-2024-43398REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6…5.9
• CVE-2024-43399Mobile Security Framework (MobSF) is a pen-testing, malware …9.8
• CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a…7.5
• CVE-2024-43400XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2024-43401XWiki Platform is a generic wiki platform offering runtime s…8
• CVE-2024-43402Rust is a programming language. The fix for CVE-2024-24576, …8.8