Description
A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ShenYu Admin | Apache ShenYu Admin 2.3.0-2.4.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 7 repositories
-
fengwenhua/CVE-2021-37580 ★ 38 · Nov 17, 2021
CVE-2021-37580的poc
-
Liang2580/CVE-2021-37580 ★ 7 · Nov 19, 2021
CVE-2021-37580
-
ZororoZ/CVE-2021-37580 ★ 5 · Nov 19, 2021
-
rabbitsafe/CVE-2021-37580 ★ 4 · Nov 17, 2021
-
CN016/Apache-ShenYu-Admin-JWT-CVE-2021-37580- ★ 1 · Oct 10, 2023
Apache ShenYu Admin JWT认证绕过漏洞(CVE-2021-37580)
-
Wing-song/CVE-2021-37580 ★ 0 · Nov 19, 2021
Apache ShenYu 管理员认证绕过
-
Osyanina/westone-CVE-2021-37580-scanner ★ 0 · Nov 19, 2021
A vulnerability scanner that detects CVE-2021-37580 vulnerabilities.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache ShenYu Admin JWT - Authentication Bypass http/cves/2021/CVE-2021-37580.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.shenyu:shenyu-admin | >= 2.3.0, < 2.4.1 | 2.4.1 | GHSA-vpfp-5gwq-g533 |