Vulnerabilities for Shenyu (...) - CXSECURITY.COM

Vulnerabilities for 'Shenyu'

2022-05-17

CVE-2022-26650

CWE-862

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

2022-01-25

CVE-2021-45029

CWE-94

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVE-2022-23223

CWE-522

The HTTP response will disclose the user password. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVE-2022-23944

CWE-306

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVE-2022-23945

CWE-306

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

2021-11-16

CVE-2021-37580

CWE-287

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

>>> Vendor: Apache 247 Products

Mod auth radius

Coyote http connector

Open for business project

Apache http server

Tomcat jk web server connector

Myfaces tomahawk

Apache webserver

Portable runtime

Apache commons daemon

Http server2.0a1

Http server2.0a2

Http server2.0a3

Http server2.0a4

Http server2.0a5

Http server2.0a6

Http server2.0a7

Http server2.0a8

Http server2.0a9

Commons-compress

Org.apache.sling.servlets.post

Commons-httpclient

Commons fileupload

Struts2-showcase

Xml security for c++

Xml security for java

Sling auth core component

Httpasyncclient

Mod auth mellon

Santuario xml security for java

See all Products for Vendor Apache

Copyright 2024, cxsecurity.com