CVE-2022-23945 — HIGH (7.5)

Vulnerability Description

Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Apache	Shenyu	2.4.0

Related Weaknesses (CWE)

CWE-306 CWE-862

References

http://www.openwall.com/lists/oss-security/2022/01/25/6Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/26/3Mailing ListPatchThird Party Advisory
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8sMailing ListNot ApplicableVendor Advisory
http://www.openwall.com/lists/oss-security/2022/01/25/6Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/26/3Mailing ListPatchThird Party Advisory
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8sMailing ListNot ApplicableVendor Advisory

FAQ

What is CVE-2022-23945?

CVE-2022-23945 is a vulnerability with a CVSS score of 7.5 (HIGH). Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

How severe is CVE-2022-23945?

CVE-2022-23945 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-23945?

Check the references section above for vendor advisories and patch information. Affected products include: Apache Shenyu.