CVE-2021-37580

CVE-2021-37580 POC for CVE-2021-37580 0x00 Vulnerability Principle Vulnerability principle: Apache ShenYu Admin bypass JWT authentication CVE-2021-37580 0x01 Single URL Usage: python3 CVE-2021-37580.py -u url -n username.txt For shenyu-admin-2.4.0, vulnerable versions see below: For...

CVE-2021-37580

Apache ShenYu Admin has an authentication bypass vulnerability that allows attackers to bypass JSON Web Token JWT security authentication and directly access the system backend. Apache ShenYu is an extensible, high-performance, and reactive API gateway solution used in all microservice scenarios...

Apache-ShenYu-Admin-JWT-CVE-2021-37580-

This repository does not have a README...

CVE-2022-23945

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

VulnCheck KEV: CVE-2021-37580

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0...

org.apache.shenyu:shenyu-admin-dist (>=2.4.0, <=2.4.3) potentially affected by CVE-2023-25753 via org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.3)

org.apache.shenyu:shenyu-admin MAVEN version =2.4.0, =2.4.0, =2.4.3 Source cves: CVE-2023-25753 Source advisory: GHSA-7W8V-5FCQ-PVQW...

org.apache.shenyu:shenyu-admin-dist (>=2.4.0, <=2.4.3) potentially affected by CVE-2023-25753 via org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.3)

org.apache.shenyu:shenyu-admin MAVEN version =2.4.0, =2.4.0, =2.4.3 Source cves: CVE-2023-25753 Source advisory: OSV:GHSA-7W8V-5FCQ-PVQW...

org.apache.shenyu:shenyu-admin-dist (>=2.4.0, <=2.4.3) potentially affected by CVE-2023-25753 via org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.3)

org.apache.shenyu:shenyu-admin MAVEN version =2.4.0, =2.4.0, =2.4.3 Source cves: CVE-2023-25753 Source advisory: MEND:CVE-2023-25753...

Privilege Escalation

shenyu-admin is vulnerable to Privilege Escalation. The vulnerability is due to the library allowing low-privilege low-level administrators to create users with higher privileges than their own...

org.apache.shenyu:shenyu-admin-dist (>=2.4.0, <=2.4.3) potentially affected by CVE-2022-42735 via org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.3)

org.apache.shenyu:shenyu-admin MAVEN version =2.4.0, =2.4.0, =2.4.3 Source cves: CVE-2022-42735 Source advisory: OSV:GHSA-VF8H-2WWJ-JQ22...

org.apache.shenyu:shenyu-admin-dist (>=2.4.0, <=2.4.3) potentially affected by CVE-2022-42735 via org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.3)

org.apache.shenyu:shenyu-admin MAVEN version =2.4.0, =2.4.0, =2.4.3 Source cves: CVE-2022-42735 Source advisory: MEND:CVE-2022-42735...

CVE-2022-37435

Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3...

Apache ShenYu security vulnerabilities

Apache ShenYu is an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation. A security vulnerability exists in Apache ShenYu Admin versions 2.4.2 and 2.4.3, which stems from an insecure privilege that could allow a low-privileged administrator to change...

GHSA-7RJP-FGWJ-47RW Missing authentication in ShenYu

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

com.gitee.pulanos.pangu:pangu-gateway-spring-boot-starter (>=5.0.7, <=5.1.0), org.apache.shenyu:shenyu-admin (>=2.4.0, <=2.4.1) +108 more potentially affected by CVE-2021-45029 via org.apache.shenyu:shenyu-common (>=2.4.0, <=2.4.1)

org.apache.shenyu:shenyu-common MAVEN version =2.4.0, =5.0.7, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.1 and more Source cves: CVE-2021-45029 Source advisory: OSV:GHSA-GH38-X2WM-XMC8...

CVE-2022-23945

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-23945

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

Authentication flaw

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-23945 Apache ShenYu missing authentication allows gateway registration

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1...

CVE-2022-23945

CVE-2022-23945 describes a missing authentication flaw in the ShenYu Admin interface when registering over HTTP, affecting Apache ShenYu versions 2.4.0 and 2.4.1 . The connected sources consistently state the issue as an authentication gap without providing additional technical specifics within t...