Apache Shenyu Incubating (Apache Software Foundation) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2022-05-17. Vendor: Apache Software Foundation.

CVEs of Apache Shenyu Incubating

• CVE-2022-26650 - CVSS 7.5 (high), 2022-05-17: In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both…
• CVE-2022-23945 - CVSS 7.5 (high), 2022-01-25: Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23944 - CVSS 9.1 (critical), 2022-01-25: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23223 - CVSS 7.5 (high), 2022-01-25: On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2…
• CVE-2021-45029 - CVSS 9.8 (critical), 2022-01-25: Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.