GitHub Advisoryadvisory · Maven
GHSA-7wq4-89xx-g62j Password exposure in ShenYu
HIGH
Official page ↗
- Aliases
- CVE-2022-23223
- Ecosystem
- Maven
- Packages
- org.apache.shenyu:shenyu-common
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-522
- Reviewed
- 2022-01-26
Affected packages
• Maven org.apache.shenyu:shenyu-common: >= 2.4.0, < 2.4.2 → fixed in 2.4.2
Description
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Related
Alias · CVE (1)
- CVE-2022-23223 On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-23223 advisory
- https://github.com/apache/shenyu/pull/2357 web
- https://github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654 web
- https://github.com/apache/incubator-shenyu web
- https://github.com/apache/incubator-shenyu/releases/tag/v2.4.2 web
- https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s web
- http://www.openwall.com/lists/oss-security/2022/01/25/7 web
- http://www.openwall.com/lists/oss-security/2022/01/26/4 web