Lucene search

GitHub Advisory DatabaseGHSA-VF8H-2WWJ-JQ22

HistoryFeb 15, 2023 - 12:30 p.m.

Privilege escalation in Apache ShenYu

2023-02-1512:30:26

CWE-269

GitHub Advisory Database

github.com

apache shenyu

privilege management

vulnerability

upgrade

patch

low-level administrators

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.6%

JSON

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958.

Affected configurations

Vulners

Node

org.apache.shenyu\shenyuMatchadmin

CPENameOperatorVersion
org.apache.shenyu:shenyu-adminlt2.5.1

CPE	Name	Operator	Version
	org.apache.shenyu:shenyu-admin	lt	2.5.1

References

github.com/advisories/GHSA-vf8h-2wwj-jq22

github.com/apache/shenyu/pull/3958

lists.apache.org/thread/2k8764jmckmc19qc8x51nlnngq71pcf7

nvd.nist.gov/vuln/detail/CVE-2022-42735

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.6%

JSON

Related for GHSA-VF8H-2WWJ-JQ22