Description
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/01/25/7
http://www.openwall.com/lists/oss-security/2022/01/26/4
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
Related Vulnerabilities
CVE-2022-37865 Vulnerability in maven package org.apache.ivy:ivy
CVE-2023-5572 Vulnerability in npm package @vrite/sdk
CVE-2021-37404 Vulnerability in maven package org.apache.hadoop:hadoop-hdfs-native-client
CVE-2022-28150 Vulnerability in maven package com.synopsys.jenkinsci:ownership
CVE-2021-21172 Vulnerability in maven package org.webjars.npm:electron