Password exposure in ShenYu

HIGH 7.5CVE-2022-23223 · GHSA-7wq4-89xx-g62j · Published 25/01/2022 · updated 17/06/2026

In short

CVE-2022-23223 is a HIGH (CVSS 7.5) vulnerability affecting org.apache.shenyu:shenyu-common, shenyu (apache).
Chance of exploitation in the next 30 days (EPSS): 4.3%, higher than 91.2% of all vulnerabilities.
Fix: update to 2.4.2 or later.

Package	Affected versions	Patched versions
org.apache.shenyu:shenyu-common Maven	`≥ 2.4.0, < 2.4.2`	`2.4.2`
shenyu apache	`= 2.4.0= 2.4.1`	No fix yet

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

NVD description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

References

nvd.nist.gov/vuln/detail/CVE-2022-23223 · ADVISORY
apache/shenyu#2357 · WEB
apache/shenyu commit 0e826ce · WEB
apache/incubator-shenyu · WEB
apache/incubator-shenyu release v2.4.2 · WEB
lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s · WEB
openwall.com/lists/oss-security/2022/01/25/7 · WEB
openwall.com/lists/oss-security/2022/01/26/4 · WEB

More vulnerabilities in org.apache.shenyu:shenyu-common

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.apache.shenyu:shenyu-common

Maven

≥ 2.4.0, < 2.4.2

2.4.2

shenyu

apache

= 2.4.0= 2.4.1

No fix yet

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

NVD description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

More vulnerabilities in org.apache.shenyu:shenyu-common

See all →