Information Disclosure

2022-01-2603:50:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

information disclosure

shenyu-plugin-cryptor

credentials

library

http response

vulnerability

EPSS

0.002

Percentile

59.2%

JSON

shenyu-plugin-cryptor is vulnerable to information disclosure. The vulnerability exists due to the insufficiently protected credentials in the library, allowing an attacker to gain users sensitive information through the HTTP response.

References

www.openwall.com/lists/oss-security/2022/01/25/7

www.openwall.com/lists/oss-security/2022/01/26/4

github.com/apache/incubator-shenyu/commit/29cb757d23306e2f7dda6f71f45ac2e76545e709

github.com/apache/incubator-shenyu/pull/2302

lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s