Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Apache Component: Shenyu Clear all filters
TI-2023-11025 CVE-2023-25753 · GHSA-7w8v-5fcq-pvqw

Server-Side Request Forgery in Apache ShenYu

Priority LOW 31

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01137 Published 2023-10-19 Fixed in 2.6.0 CWE-918
TI-2022-20760 CVE-2022-42735 · GHSA-vf8h-2wwj-jq22

Apache ShenYu Admin ultra vires

Priority MEDIUM 42

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0119 Published 2023-02-15 Fixed in 2.5.1 CWE-269
TI-2022-17499 CVE-2022-37435 · GHSA-fjjw-82xw-vfc2

Apache ShenYu Admin Improper Privilege Management

Priority MEDIUM 41

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01341 Published 2022-09-01 Fixed in 2.5.0 CWE-732
TI-2022-09924 CVE-2022-26650 · GHSA-cw56-j3fm-7w57

Apache ShenYu (incubating) Regular expression denial of service

Priority LOW 38

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02663 Published 2022-05-17 Fixed in 2.4.3 CWE-1333
TI-2022-07916 CVE-2022-23944 · GHSA-6v39-p2xq-g5c3

Apache ShenYu 2.4.1 Improper access control

Priority HIGH 79

User can access /plugin api without authentication.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.79007 Published 2022-01-25 Fixed in 2.4.2 CWE-862
TI-2022-07364 CVE-2022-23223 · GHSA-7wq4-89xx-g62j

Apache ShenYu Password leakage

Priority MEDIUM 40

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04306 Published 2022-01-25 Fixed in 2.4.2 CWE-522