{"id":"CVE-2020-13945","published":"2020-12-07T19:04:52Z","modified":"2024-08-04T12:32:14Z","title":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules","vendor":"Apache Software Foundation","product":"Apache APISIX","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache APISIX","versions":["1.2","1.3","1.4","1.5"]}],"description":{"text":"In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache APISIX has a flaw in its Admin API, where a user who enables the Admin API and removes its access IP restriction rules ends up with the default token able to reach APISIX management data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:33Z"},"cvss":null,"epss":{"score":0.72976,"percentile":0.99451,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-27","exploitedFirstSeen":"2026-10-27","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-27&host_type=src&vulnerability=cve-2020-13945","date":"2026-10-27"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r792feb29964067a4108f53e8579a1e9bd1c8b5b9bc95618c814faf2f%40%3Cdev.apisix.apache.org%3E","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-6132","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-6132","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2022-05-09","earliestUrl":"https://github.com/YutuSec/Apisix_Crack","repos":[{"name":"YutuSec/Apisix_Crack","url":"https://github.com/YutuSec/Apisix_Crack","stars":8,"created":"2022-05-09"},{"name":"CyberCTF/vulhub-apisix-cve-2020-13945","url":"https://github.com/CyberCTF/vulhub-apisix-cve-2020-13945","stars":0,"created":"2026-10-08"}]},"metasploit":[{"name":"APISIX Admin API default access token RCE","module":"exploit/multi/http/apache_apisix_api_default_token_rce","type":"exploit","disclosureDate":"2020-12-07","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb"}],"nuclei":[{"id":"CVE-2020-13945","name":"Apache APISIX - Insufficiently Protected Credentials","severity":"medium","path":"http/cves/2020/CVE-2020-13945.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13945.yaml"}],"first":{"date":"2020-12-07","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2020-12-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-13945","provenance":"source"},{"date":"2020-12-07","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-05-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_apisix_api_default_token_rce.rb","provenance":"source"},{"date":"2026-10-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-10-27&host_type=src&vulnerability=cve-2020-13945","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 2 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9945"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 2 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}