Back to feed
EUVD-2022-0510 · Published Jan 28, 2022
Password exposure in ShenYu On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Technologies
Apache Shenyu
Weaknesses
CWE-522
CVSS scores
- v3.17.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
- http://www.openwall.com/lists/oss-security/2022/01/26/4
- http://www.openwall.com/lists/oss-security/2022/01/25/7
- https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
- https://nvd.nist.gov/vuln/detail/CVE-2022-23223
- https://github.com/apache/shenyu/pull/2357
- https://github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654
Potentially impacted assets
See if this affects your attack surface
