Description
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache ShenYu (incubating) | Apache ShenYu (incubating) – < 2.4.2 | 2.4.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.shenyu:shenyu-common | >= 2.4.0, < 2.4.2 | 2.4.2 | GHSA-7rjp-fgwj-47rw |
References
- https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
- [oss-security] 20220125 CVE-2022-23945: Apache ShenYu missing authentication allows gateway registration mailing-list
- [oss-security] 20220126 CVE-2022-23945: Apache ShenYu (incubating) missing authentication allows gateway registration mailing-list