Apache ShenYu Admin has insecure permissions

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2022-37435 · ADVISORY
• apache/shenyu#3658 · WEB
• apache/shenyu release v2.5.0 · WEB
• lists.apache.org/thread/ndblyxr2fdrvjtgbs1bogxgv2cgk7t28 · WEB

Lỗ hổng khác của org.apache.shenyu:shenyu-common

• CVE-2023-25753TRUNG BÌNH 6.5 There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows u…
• CVE-2022-23945CAO 7.5Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23944NGHIÊM TRỌNG 9.1User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
• CVE-2022-23223CAO 7.5On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade …
• CVE-2021-45029NGHIÊM TRỌNG 9.8Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.