Description

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/01/25/8

http://www.openwall.com/lists/oss-security/2022/01/26/1

https://lists.apache.org/thread/3zzmwvg3012tg306x8o893fvdcssx639

Related Vulnerabilities

CVE-2020-26301 Vulnerability in npm package ssh2

CVE-2023-37948 Vulnerability in maven package org.jenkins-ci.plugins:oracle-cloud-infrastructure-compute

CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-media-embed

CVE-2021-44667 Vulnerability in maven package com.alibaba.nacos:nacos-common

CVE-2023-34212 Vulnerability in maven package org.apache.nifi:nifi-jms-processors

Severity

Critical

Classification

CWE-94 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory