WaratekVRT Sign in

Apache ShenYu CVEs

9 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (2)
Columns
Vendor apache✕Product shenyu✕
Overview 9 matches · 1 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
9matches 1protected11.1% 1exploited11.1% 0CISA KEV0.0% 2public PoC22.2% 1EPSS ≥ 0.511.1%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 1 11.1% No exploit published 7 77.8%
Critical 3 33.3% High 5 55.6% Medium 1 11.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 11.1% Working exploit published 1 11.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 77.8%
split by peak 4 / quarter
No exploit published: 7Mitigation candidate: 1Protected by Waratek: 1 Medium: 1High: 5Critical: 3 not blocked: 8blocked by ARMR today: 1 No public exploit: 7Working exploit published: 1Exploited: 1
Q4 211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q1 224 Mitigation candidate1 No exploit published3 Critical2 High2 not blocked4 Working exploit published1 No public exploit3 Q2 221 No exploit published1 High1 not blocked1 No public exploit1 Q3 221 No exploit published1 High1 not blocked1 No public exploit1 Q4 220 Q1 231 No exploit published1 High1 not blocked1 No public exploit1 Q2 230 Q3 230 Q4 231 No exploit published1 Medium1 not blocked1 No public exploit1
Q4 21Q1 22Q2 22Q3 22Q4 22Q1 23Q2 23Q3 23Q4 23
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-25753 Medium 2023-10-19 No exploit published No public exploit There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch  https://github.com/apache/shenyu/pull/4776  .
CVE-2022-42735 High 2023-02-15 No exploit published No public exploit Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .
CVE-2022-37435 High 2022-09-01 No exploit published No public exploit Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.
CVE-2022-26650 High 2022-05-17 No exploit published No public exploit In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
CVE-2022-23945 High 2022-01-25 No exploit published No public exploit Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVE-2022-23944 Critical 2022-01-25 Mitigation candidate Working exploit published User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVE-2022-23223 High 2022-01-25 No exploit published No public exploit On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
CVE-2021-45029 Critical 2022-01-25 No exploit published No public exploit Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVE-2021-37580 Critical 2021-11-16 Protected by Waratek Exploited A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0