# CVE-2021-45232

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

- Page: https://www.vulneraibility.com/cve/CVE-2021-45232
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 86.33% (percentile 99.7)
- Unvetted proof-of-concept code on GitHub: 11 GitHub proofs of concept · 1 Nuclei template (first 2021-12-28)
- Weakness: CWE-306
- Published: 2021-12-27

## Affected versions

- Apache Software Foundation Apache APISIX Dashboard: affected 2.7 and 2.7.1; 2.8; 2.9; 2.10

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://lists.apache.org/thread/979qbl6vlm8269fopfyygnxofgqyn6k5
- [other] http://www.openwall.com/lists/oss-security/2021/12/27/1

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.