fr Sign in

Not rated

CVE-2022-23945 Missing authentication on ShenYu Admin when register by HTTP

Description

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Affected products and versions

Product	Affected versions	Fixed in
Apache ShenYu (incubating) 2.4	earliest → < 2.4.2	2.4.2

References

lists.apache.org lists.apache.org
[oss-security] 20220125 CVE-2022-23945: Apache ShenYu missing authentication allows gateway registration www.openwall.com
[oss-security] 20220126 CVE-2022-23945: Apache ShenYu (incubating) missing authentication allows gateway registration www.openwall.com

Timeline

Published January 25, 2022
Last modified August 3, 2024

The 5 CVEs of Apache ShenYu (incubating) →

CVE-2022-26650 In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(),… Not rated CVE-2022-23944 User can access /plugin api without authentication Not rated CVE-2022-23223 On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users Not rated CVE-2021-45029 Groovy Code Injection & SpEL Injection which lead to Remote Code Execution Not rated

Track this CVE