fr Sign in

Not rated

CVE-2021-45029 Groovy Code Injection & SpEL Injection which lead to Remote Code Execution

Description

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Affected products and versions

Product	Affected versions	Fixed in
Apache ShenYu (incubating) 2.4	earliest → < 2.4.2	2.4.2

References

lists.apache.org lists.apache.org
[oss-security] 20220125 CVE-2021-45029: Groovy Code Injection & SpEL Injection in Apache ShenYu 2.4.1 www.openwall.com
[oss-security] 20220126 CVE-2021-45029: Apache ShenYu (incubating) Groovy Code Injection and SpEL Injection www.openwall.com

Timeline

Published January 25, 2022
Last modified August 4, 2024

The 5 CVEs of Apache ShenYu (incubating) →

CVE-2022-26650 In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(),… Not rated CVE-2022-23945 Missing authentication on ShenYu Admin when register by HTTP Not rated CVE-2022-23944 User can access /plugin api without authentication Not rated CVE-2022-23223 On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users Not rated

Track this CVE