high7.5
CVE-2022-23223
Password exposure in ShenYu
Impact
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.shenyu:shenyu-common | >= 2.4.0, < 2.4.2 | 2.4.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Shenyu | Versions 2.4.0, 2.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2022/01/25/7
- http://www.openwall.com/lists/oss-security/2022/01/26/4
- https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
- https://github.com/advisories/GHSA-7wq4-89xx-g62j
- https://nvd.nist.gov/vuln/detail/CVE-2022-23223
- https://github.com/apache/incubator-shenyu/releases/tag/v2.4.2
- https://github.com/apache/shenyu/pull/2357
- https://github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654