Description

The Kong Gateway provides API for accessing various information and configuring it. Acunetix determined that it was possible to access this API without authentication.

Remediation

Restrict access to the Kong Gateway API interface

References

OWASP Authentication Cheat Sheet

Securing the Admin API

Related Vulnerabilities

MyBB Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-4625)

Nuxt.js Running in Development Mode

TLS/SSL Sweet32 attack

WordPress Plugin GiveWP-Donation and Fundraising Platform Information Disclosure (2.20.2)

TYPO3 Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4900)

Severity

High

Classification

CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Tags

Configuration