Vulnerability identifier: #VU60580

Vulnerability risk: High

CVSSv3.1: 9.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2022-24112

CWE-ID: CWE-94

Exploitation vector: Network

Exploits in database: 11

• December 4, 2022
  • CVE-2022-24112_POC (CVE-2022-24112_POC) [Github]
• May 13, 2022
  • Apache APISIX 2.12.1 - Remote Code Execution (RCE) [Exploit-DB]
• May 12, 2022
  • APISIX Admin API default access token RCE [Metasploit]
• March 17, 2022
  • CVE-2022-24112-POC (Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token) [Github]
  • Apache-APISIX-CVE-2022-24112 (Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept exploit ) [Github]
• March 9, 2022
  • CVE-2022-24112 (CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability) [Github]
• March 8, 2022
  • CVE-2022-244112 (CVE-2022-24112: Apache APISIX Remote Code Execution Vulnerability) [Github]
• February 27, 2022
  • CVE-2022-24112 (Apache APISIX batch-requests RCE(CVE-2022-24112)) [Github]
• February 22, 2022
  • CVE-2022-24112 (CVE-2022-24112：Apache APISIX apisix/batch-requests RCE) [Github]
  • CVE-2022-24112 (Apache APISIX apisix/batch-requests RCE) [Github]
• February 21, 2022
  • CVE-2022-24112 (CVE-2022-24112 check) [Github]

Impact: Code execution

Vulnerable software:
Apache APISIX
Server applications / Other server solutions

Vendor: Apache Foundation