CVE-2022-23223 Apache ShenYu Password leakage
An exposed endpoint in Apache ShenYu allows attackers to read all user passwords, requiring an upgrade to secure credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23223?
CVE-2022-23223 is a high-severity vulnerability in Apache ShenYu (incubating), published on 25 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Weakness: CWE-522
Which versions are affected by CVE-2022-23223?
2 open source packages ship an affected version, including org.apache.shenyu:shenyu-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
Products include Apache Shenyu.
How do I fix CVE-2022-23223?
Upgrade org.apache.shenyu:shenyu-common to 2.4.2 or later.
Is CVE-2022-23223 being exploited?
There is no known exploitation of CVE-2022-23223 in the wild and no public exploit code.
Other vulnerabilities in Apache ShenYu (incubating)
- CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication
- CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
- CVE-2022-42735 Apache ShenYu Admin ultra vires
- CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
Sources
Also known as GHSA-7wq4-89xx-g62j.