Lucene search

K
cve[email protected]CVE-2022-42735
HistoryFeb 15, 2023 - 10:15 a.m.

CVE-2022-42735

2023-02-1510:15:16
CWE-269
web.nvd.nist.gov
28
cve-2022-42735
apache software foundation
apache shenyu
vulnerability
privilege management
upgrade
patch
nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.5%

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own.

This issue affects Apache ShenYu: 2.5.0.

Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .

Affected configurations

Vulners
NVD
Node
apacheshenyuRange2.5.0
CPENameOperatorVersion
apache:shenyuapache shenyueq2.5.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache ShenYu",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.5%