Lucene search

GitHub Advisory DatabaseGHSA-VF8H-2WWJ-JQ22

HistoryFeb 15, 2023 - 12:30 p.m.

Privilege escalation in Apache ShenYu

2023-02-1512:30:26

CWE-269

GitHub Advisory Database

github.com

apache shenyu

privilege management

vulnerability

upgrade

patch

low-level administrators

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

61.2%

JSON

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958.

Affected configurations

Vulners

Node

org.apache.shenyushenyu-adminRange<2.5.1

VendorProductVersionCPE
org.apache.shenyushenyu-admin*cpe:2.3:a:org.apache.shenyu:shenyu-admin:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.apache.shenyu	shenyu-admin	*	cpe:2.3:a:org.apache.shenyu:shenyu-admin::::::::

References

github.com/advisories/GHSA-vf8h-2wwj-jq22

github.com/apache/shenyu/pull/3958

lists.apache.org/thread/2k8764jmckmc19qc8x51nlnngq71pcf7

nvd.nist.gov/vuln/detail/CVE-2022-42735

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

61.2%

JSON

Related for GHSA-VF8H-2WWJ-JQ22