HackerFeeds
All CVEs

CVE-2022-24112

CRITICAL9.8
CISA KEV

Published 2022-02-11 · Updated 2026-06-17 · Source security@apache.org

Summary

CVE-2022-24112 is a critical-severity (CVSS 9.8) vulnerability in Apache APISIX. CISA added it to the Known Exploited Vulnerabilities catalog on August 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 15, 2022. CISA does not currently list it as used in ransomware campaigns. Apache has 41 vulnerabilities in the KEV catalog, 8 of them linked to ransomware.

All 41 known-exploited Apache vulnerabilities →

Description

An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel, the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code, this check can be bypassed.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-290CWE-290

CISA Known-Exploited Vulnerability

Product: Apache — APISIX

Name: Apache APISIX Authentication Bypass Vulnerability

Date added: 2022-08-25 · Due: 2022-09-15

Required action: Apply updates per vendor instructions.

References

View on NVD