Privilege escalation in Apache ShenYu

2023-02-1512:30:26

Google

osv.dev

apache shenyu

privilege escalation

improper privilege management

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

57.6%

JSON

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958.

CPENameOperatorVersion
org.apache.shenyu:shenyu-admineq2.4.2
org.apache.shenyu:shenyu-admineq2.4.0
org.apache.shenyu:shenyu-admineq2.4.3
org.apache.shenyu:shenyu-admineq2.4.1
org.apache.shenyu:shenyu-admineq2.5.0

Name	Operator	Version
org.apache.shenyu:shenyu-admin	eq	2.4.2
org.apache.shenyu:shenyu-admin	eq	2.4.0
org.apache.shenyu:shenyu-admin	eq	2.4.3
org.apache.shenyu:shenyu-admin	eq	2.4.1
org.apache.shenyu:shenyu-admin	eq	2.5.0