CVE-2021-37580

Published: Nov 16, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Affected (2)

Products: Apache: Shenyu

Apache

1 product

Shenyu

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Shenyu	Version 2.3.0
Apache Shenyu	Version 2.4.0

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

http://www.openwall.com/lists/oss-security/2021/11/16/1

Source: security@apache.org

Mailing ListThird Party Advisory

https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2021/11/16/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.