PT-2022-1763 · Apache · Apache Shenyu

Zhang Yonglun · Published 2022-01-25 · Updated 2023-10-16 · CVE-2022-23223

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.0 through 2.4.1

Description The issue is related to insufficient protection of registration data, allowing a remote attacker to obtain user registration data using a specially crafted HTTP request. This can lead to the disclosure of user passwords. The estimated number of potentially affected devices is not specified.

Recommendations For Apache ShenYu versions 2.4.0 and 2.4.1, upgrade to version 2.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected endpoint to minimize the risk of exploitation. Avoid using the affected HTTP endpoint until the issue is resolved.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

BDU:2022-01061

CVE-2022-23223

GHSA-7WQ4-89XX-G62J

Affected Products

Apache Shenyu

References · 14

• 🔥 http://openwall.com/lists/oss-security/2022/01/26/4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-23223 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20220127.4.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2022-23223 · Vendor Advisory
• https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01061 · Security Note
• https://osv.dev/vulnerability/GHSA-7wq4-89xx-g62j · Vendor Advisory
• https://github.com/apache/incubator-shenyu/releases/tag/v2.4.2 · Note
• https://github.com/apache/shenyu/commit/0e826ceae97a1258cb15c73a3072118c920e8654 · Note
• https://github.com/apache/shenyu/pull/2357 · Note
• https://github.com/apache/incubator-shenyu · Note
• https://t.me/cibsecurity/36207 · Telegram Post
• https://t.me/cvenotify/54271 · Telegram Post
• http://openwall.com/lists/oss-security/2022/01/25/7 · Note