CVE-2021-45029 — Code Injection in Software Foundation Apache Shenyu

CWE-94 — Code Injection4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
10.4%
top 6.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache ShenyuApache Shenyu
Timeline
PublishedJan 25
Latest updateJan 28

Description

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5apache_software_foundation/apache_shenyuApache ShenYu (incubating) — 2.4.2
▶NVDapache/shenyu2.4.0, 2.4.1+1

🔴Vulnerability Details

3
OSV
Code injection in ShenYu↗2022-01-28
▶
GHSA
Code injection in ShenYu↗2022-01-28
▶
CVEList
Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection↗2022-01-25
▶
CVE-2021-45029 — Code Injection | cvebase