[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CA+ZBtZ6UjvTNKgO6K6Auqxfoue+WzS41BGzN=i6KGuiVurvS+g@mail.gmail.com>
Date: Wed, 15 Feb 2023 11:19:22 +0800
From: Zhang Yonglun <zhangyonglun@...che.org>
To: oss-security@...ts.openwall.com
Cc: dev@...nyu.apache.org
Subject: CVE-2022-42735: Apache ShenYu Admin ultra vires
Severity: low
Description:
Improper Privilege Management vulnerability in Apache Software
Foundation Apache ShenYu.
ShenYu Admin allows low-privilege low-level administrators create
users with higher privileges than their own.
This issue affects Apache ShenYu: 2.5.0.
Work Arounds:
Upgrade to Apache ShenYu 2.5.1 or apply patch
https://github.com/apache/shenyu/pull/3958.
Credit:
xxhzz (finder)
References:
https://shenyu.apache.org
https://www.cve.org/CVERecord?id=CVE-2022-42735
--
Zhang Yonglun
Apache ShenYu & ShardingSphere
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
