Advisory Weakness Curation

apollo-portal has potential CSRF issue ### Impact A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. ### Patches Cookie SameSite strategy was set to Lax in #4664 and was released in v2.1.0 https://github.com/apolloconfig/apollo/releases/tag/v2.1.0. ### Workarounds To fix the potential issue without upgrading, simply follow the advice that does not visit unknown source pages. ### References Apollo Security Guidence https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related ### For more information If you have any questions or comments about this advisory: * Open an issue in issue https://github.com/apolloconfig/apollo/issues * Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)

apollo-portal has potential CSRF issue Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages.