[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2022-23945: Apache ShenYu (incubating) missing authentication allows gateway regi
From:       Zhang Yonglun <zhangyonglun () apache ! org>
Date:       2022-01-26 6:40:38
Message-ID: CA+ZBtZ7__rBfj7EgGm9sibydEc-Xyep9ctp8z7BTMqhLf7enVQ () mail ! gmail ! com
[Download RAW message or body]

Severity: moderate

Description:

Missing  authentication on ShenYu Admin when a gateway registers. So,
if ShenYu Admin is exposed to the internet, it will allow any user to
register as the gateway.
This issue affects Apache ShenYu (incubating) 2.4.0 and 2.4.1.

Mitigation:

Upgrade to Apache ShenYu (incubating) 2.4.2 or apply patch
https://github.com/apache/incubator-shenyu/pull/2723.


--

Zhang Yonglun
Apache ShenYu (Incubating)
Apache ShardingSphere
[prev in list] [next in list] [prev in thread] [next in thread]