← Back

CVE-2022-23223

nvd nist
Published: Jan 25, 2022Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

Affected (2)

Products: Apache: Shenyu
Apache
1 product
Shenyu
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Apache
Shenyu
Version 2.4.0
Shenyu
Version 2.4.1

Related CWEs

CWE-522
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (6)

Source: security@apache.org
Mailing ListThird Party Advisory
Source: security@apache.org
ExploitMailing ListPatchThird Party Advisory
Source: security@apache.org
Mailing ListVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListVendor Advisory

Timeline

No history available yet.