CVE-2020-13945: 
Apache APISIX vulnerability analysis and mitigation

In Apache APISIX versions 1.2, 1.3, 1.4, and 1.5, a security vulnerability was identified where if users enabled the Admin API and deleted the Admin API access IP restriction rules, the default token could be used to access APISIX management data (NVD, CVE Mitre).

The vulnerability (CVE-2020-13945) is related to the Admin API access control mechanism in Apache APISIX. The issue occurs when the Admin API is enabled and the IP restriction rules for API access are removed, allowing unauthorized access to management data using the default token (NVD).

When exploited, this vulnerability allows unauthorized access to APISIX management data, potentially compromising the security and integrity of the API gateway configuration (NVD).

The vulnerability has been documented and can be exploited when the Admin API is enabled and IP restriction rules are removed. Technical details about exploitation have been published (Packet Storm).

The vulnerability was officially announced and discussed in the Apache Software Foundation's mailing lists, indicating a coordinated disclosure process (Apache Lists).