Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

Remediation

References

https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s

http://www.openwall.com/lists/oss-security/2022/01/25/7

http://www.openwall.com/lists/oss-security/2022/01/26/4

Related Vulnerabilities

CVE-2020-27196 Vulnerability in maven package com.typesafe.play:play-java

CVE-2022-45386 Vulnerability in maven package org.jenkins-ci.plugins:violations

CVE-2022-24728 Vulnerability in maven package org.webjars.bowergithub.ckeditor:ckeditor4

CVE-2020-35491 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2021-41164 Vulnerability in npm package ckeditor4

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Vendor Advisory Third Party Advisory Exploit Patch