Description

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Remediation

References

http://www.openwall.com/lists/oss-security/2021/11/16/1

https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb

Related Vulnerabilities

CVE-2022-3952 Vulnerability in maven package com.manydesigns:portofino-microservice-launcher

CVE-2020-35149 Vulnerability in npm package rxdb

CVE-2022-36922 Vulnerability in maven package org.jenkins-ci.plugins:lucene-search

CVE-2023-43501 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2021-40369 Vulnerability in maven package org.apache.jspwiki:jspwiki-main

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory CWE-287