Password exposure in ShenYu

Description

References

• nvd.nist.gov/vuln/detail/CVE-2022-23223 · ADVISORY
• apache/shenyu#2357 · WEB
• apache/shenyu commit 0e826ce · WEB
• apache/incubator-shenyu · WEB
• apache/incubator-shenyu release v2.4.2 · WEB
• lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s · WEB
• openwall.com/lists/oss-security/2022/01/25/7 · WEB
• openwall.com/lists/oss-security/2022/01/26/4 · WEB

Autres vulnérabilités de org.apache.shenyu:shenyu-common

• CVE-2023-25753MOYENNE 6.5 There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows u…
• CVE-2022-37435ÉLEVÉE 8.8Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's password…
• CVE-2022-23945ÉLEVÉE 7.5Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23944CRITIQUE 9.1User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2021-45029CRITIQUE 9.8Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.