Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo

严重 10.0CVE-2019-10686 · GHSA-fvx3-g627-phm2 · Published 01/04/2019 · updated 17/06/2026

要点

CVE-2019-10686 是影响 com.ctrip.framework.apollo:apollo, apollo (ctrip) 的严重 (CVSS 10.0)漏洞。
未来 30 天内被利用的概率（EPSS）：1.6%，高于 75.3% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
com.ctrip.framework.apollo:apollo Maven	`≤ 1.3.0`	No fix yet
apollo ctrip	`≤ 1.3.0`	No fix yet

Description

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

NVD description

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via /system-info/health because the %23 substring is mishandled.

References

nvd.nist.gov/vuln/detail/CVE-2019-10686 · ADVISORY
ctripcorp/apollo · WEB
GitHub Advisory GHSA-fvx3-g627-phm2 · ADVISORY
ctripcorp/apollo · PACKAGE

com.ctrip.framework.apollo:apollo 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.ctrip.framework.apollo:apollo

Maven

≤ 1.3.0

No fix yet

apollo

ctrip

≤ 1.3.0

No fix yet

Description

NVD description

com.ctrip.framework.apollo:apollo 的其他漏洞

查看全部 →