Shenyu vulnerabilities

4 known vulnerabilities in Shenyu from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Apache ShenYu: Improper Privilege Management

  CVE-2022-42735Feb 15, 2023ApacheEPSS 1.19%

  Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache S

• 8.8 High severity

  Apache ShenYu: Incorrect Permission Assignment for Critical Resource

  CVE-2022-37435Sep 1, 2022ApacheEPSS 1.34%

  Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.

• 7.5 High severity

  Apache ShenYu (incubating): Inefficient Regular Expression Complexity

  CVE-2022-26650May 17, 2022ApacheEPSS 2.66%

  In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions

• 7.5 High severity

  Apache ShenYu (incubating): Insufficiently Protected Credentials

  CVE-2022-23223Jan 25, 2022ApacheEPSS 4.31%

  On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.