CVE-2022-23944: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

PriorityP185critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EXPLOIT

EPSS

79.01%

99.5th percentile

User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	shenyu	—	—
apache	shenyu	—	—
apache_software_foundation	apache_shenyu	>= Apache ShenYu (incubating) < 2.4.2	2.4.2

Detection & IOCsextracted from sources · hover to see the quote

path/plugin↗

→Send an unauthenticated HTTP GET request to /plugin endpoint; a 200 response containing both '"message":"query success"' and '"code":200' in the body confirms the vulnerability.

·Vulnerability affects Apache ShenYu versions 2.4.0 and 2.4.1 only; version 2.4.2 and later are patched. ↗
·The unauthenticated access is specific to the /plugin API endpoint in the Apache ShenYu Admin panel; no credentials are required to trigger the vulnerability.

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.