Vulnerabilities

TI-2022-07917 CVE-2022-23945 · GHSA-7rjp-fgwj-47rw

Apache ShenYu missing authentication allows gateway registration

LOW 39

Missing authentication on ShenYu Admin when register by HTTP.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03771 Published 2022-01-25 Fixed in 2.4.2 CWE-862

TI-2022-07916 CVE-2022-23944 · GHSA-6v39-p2xq-g5c3

HIGH 79

User can access /plugin api without authentication.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.79007 Published 2022-01-25 Fixed in 2.4.2 CWE-862

TI-2022-07364 CVE-2022-23223 · GHSA-7wq4-89xx-g62j

MEDIUM 40

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04306 Published 2022-01-25 Fixed in 2.4.2 CWE-522

TI-2021-20381 CVE-2021-45029 · GHSA-gh38-x2wm-xmc8

MEDIUM 51

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06029 Published 2022-01-25 Fixed in 2.4.2 CWE-94