Shenyu (Apache) - vulnerabilities (CVEs)

9 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2023-10-19. Vendor: Apache.

CVEs of Shenyu

• CVE-2023-25753 - CVSS 6.5 (medium), 2023-10-19: There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate…
• CVE-2022-42735 - CVSS 8.8 (high), 2023-02-15: Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create…
• CVE-2022-37435 - CVSS 8.8 (high), 2022-09-01: Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue…
• CVE-2022-26650 - CVSS 7.5 (high), 2022-05-17: In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both…
• CVE-2022-23223 - CVSS 7.5 (high), 2022-01-25: On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2…
• CVE-2022-23945 - CVSS 7.5 (high), 2022-01-25: Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23944 - CVSS 9.1 (critical), 2022-01-25: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2021-45029 - CVSS 9.8 (critical), 2022-01-25: Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2021-37580 - CVSS 9.8 (critical), 2021-11-16: A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected…