Apache Software Foundation Vulnerabilities and Affected Products
Vulnerabilities associated with Apache ShenYu (incubating).
Products
Clear product- Apache Airflow148 vulnerabilities
- Apache HTTP Server119 vulnerabilities
- Apache Tomcat111 vulnerabilities
- Apache Traffic Server95 vulnerabilities
- Apache Superset65 vulnerabilities
- Apache OFBiz51 vulnerabilities
- Apache CXF45 vulnerabilities
- Apache NiFi43 vulnerabilities
- Apache Camel42 vulnerabilities
- Apache ActiveMQ34 vulnerabilities
- Apache CloudStack31 vulnerabilities
- Apache DolphinScheduler31 vulnerabilities
- Apache InLong31 vulnerabilities
- Apache Thrift28 vulnerabilities
- Apache OpenOffice26 vulnerabilities
- Apache IoTDB25 vulnerabilities
- Apache Zeppelin25 vulnerabilities
- Apache Answer24 vulnerabilities
- Apache Solr24 vulnerabilities
- Apache Struts24 vulnerabilities
- Apache APISIX23 vulnerabilities
- Apache OpenMeetings23 vulnerabilities
- Apache Ranger23 vulnerabilities
- Apache JSPWiki22 vulnerabilities
- Apache Fineract20 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2022-26650HIGH | Apache ShenYu (incubating) Regular expression denial of serviceIn Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3. | CVSS7.5v3.1 | EPSS2.56% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23945HIGH | Apache ShenYu missing authentication allows gateway registrationMissing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1. | CVSS7.5v3.1 | EPSS3.77% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23944CRITICAL | Apache ShenYu 2.4.1 Improper access controlUser can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. | CVSS9.1v3.1 | EPSS79% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2022-23223HIGH | Apache ShenYu Password leakageOn Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later. CWE-522Jan 25, 2022 | CVSS7.5v3.1 | EPSS4.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2021-45029CRITICAL | Apache ShenYu 2.4.1 Groovy Code Injection & SpEL InjectionGroovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1. CWE-94Jan 25, 2022 | CVSS9.8v3.1 | EPSS6.03% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |