EUVD-2025-20132Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).
Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.
Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.
Analysis
Incorrect Permission Assignment for Critical Resource vulnerability in Apache APISIX(java-plugin-runner).
Local listening file permissions in APISIX plugin runner allow a local attacker to elevate privileges. This issue affects Apache APISIX(java-plugin-runner): from 0.2.0 through 0.5.0.
Users are recommended to upgrade to version 0.6.0 or higher, which fixes the issue.
Technical ContextAI
This vulnerability is classified as Incorrect Permission Assignment for Critical Resource (CWE-732).
RemediationAI
Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Rated medium sev
The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. Rated high severity (CVSS 7.
In Apache APISIX before 2.13.0, when decoding JSON with duplicate keys, lua-cjson will choose the last occurred value as
CPU exhaustion via algorithmic complexity in Apache APISIX 3.17.0 allows unauthenticated remote attackers to pin a gatew
In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the er
LDAP injection in Apache APISIX's ldap-auth plugin allows a caller holding valid credentials for any LDAP directory entr
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverles
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forwa
Authorization bypass and privilege escalation in Apache APISIX 3.11.0-3.17.0 stem from the `attach-consumer-label` plugi
CVE-2025-46647 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management proce
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today