Description

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/01/25/8

http://www.openwall.com/lists/oss-security/2022/01/26/1

https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639

Related Vulnerabilities

CVE-2022-43408 Vulnerability in maven package org.jenkins-ci.plugins.pipeline-stage-view:pipeline-stage-view

CVE-2022-40955 Vulnerability in maven package org.apache.inlong:sort-connector-base

CVE-2020-16024 Vulnerability in npm package electron

CVE-2020-8897 Vulnerability in maven package com.amazonaws:aws-encryption-sdk-java

CVE-2020-11023 Vulnerability in maven package org.webjars.bowergithub.jquery:jquery

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory