CVE-2022-23223

CWE-522 — Insufficiently Protected Credentials4 documents4 sources
Severity
7.5HIGH
EPSS
4.6%
top 10.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Shenyu (incubating)Apache Shenyu
Timeline
PublishedJan 25
Latest updateJan 28

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶Mavenorg.apache.shenyu:shenyu-common2.4.0 — 2.4.2
▶CVEListV5apache_software_foundation/apache_shenyu_(incubating)Apache ShenYu (incubating) — 2.4.2
▶NVDapache/shenyu2.4.0, 2.4.1+1

Patches

Patch: www.openwall.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
OSV
Password exposure in ShenYu↗2022-01-28
▶
GHSA
Password exposure in ShenYu↗2022-01-28
▶
CVEList
Apache ShenYu Password leakage↗2022-01-25
▶