Description
On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.
Remediation
References
http://www.openwall.com/lists/oss-security/2022/01/25/7
http://www.openwall.com/lists/oss-security/2022/01/26/4
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
Related Vulnerabilities
CVE-2019-0195 Vulnerability in maven package org.apache.tapestry:tapestry-core
CVE-2021-39149 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2021-46704 Vulnerability in npm package genieacs
CVE-2023-26049 Vulnerability in maven package org.eclipse.jetty:jetty-http
CVE-2021-21344 Vulnerability in maven package com.thoughtworks.xstream:xstream