CVE-2022-42735 Apache ShenYu Admin ultra vires

2023-02-1509:38:55

CWE-269

apache

www.cve.org

cve-2022-42735

apache shenyu

privilege management

upgrade

patch

8.9 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

57.6%

JSON

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.

ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own.

This issue affects Apache ShenYu: 2.5.0.

Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache ShenYu",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.5.0",
        "status": "affected",
        "version": "0",
        "versionType": "maven"
      }
    ]
  }
]