PT-2022-23995 · Apache · Apache Shenyu

Lulu Gu · Published 2022-09-01 · Updated 2023-08-02 · CVE-2022-37435

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.4.2 through 2.4.3

Description The issue is related to insecure permissions in Apache ShenYu Admin, which may allow low-privilege administrators to modify high-privilege administrator's passwords.

Recommendations For versions 2.4.2 and 2.4.3, update to version 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the administrator password modification functionality until a patch is applied.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-37435

GHSA-FJJW-82XW-VFC2

Affected Products

Apache Shenyu

References · 7

• https://lists.apache.org/thread/ndblyxr2fdrvjtgbs1bogxgv2cgk7t28 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37435 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37435 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjjw-82xw-vfc2 · Vendor Advisory
• https://github.com/apache/shenyu/releases/tag/v2.5.0 · Note
• https://github.com/apache/shenyu/pull/3658 · Note
• https://t.me/cibsecurity/49166 · Telegram Post