cve,link,title,description,vendor,products,score,severity,epss,cisa,cisa_published,article,ransomware,exploited,exploited_date,poc,trended,trended_no_1,trended_no_1_date,published,trended_score
CVE-2023-25753,https://securityvulnerability.io/vulnerability/CVE-2023-25753,Server-Side Request Forgery in Apache ShenYu,"
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter.

Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing.

This issue affects Apache ShenYu: 2.5.1.

Upgrade to Apache ShenYu 2.6.0 or apply patch  https://github.com/apache/shenyu/pull/4776  .

",Apache,Apache Shenyu,6.5,MEDIUM,0.0019399999873712659,false,,false,false,false,,,false,false,,2023-10-19T09:15:00.000Z,0
CVE-2022-42735,https://securityvulnerability.io/vulnerability/CVE-2022-42735,Apache ShenYu Admin ultra vires,"The Apache ShenYu Admin interface contains an improper privilege management vulnerability that allows low-privileged administrators to erroneously create users with elevated privileges, which could lead to unauthorized access and manipulation of user rights. This issue specifically affects version 2.5.0 of Apache ShenYu. To mitigate this vulnerability, it is recommended to upgrade to Apache ShenYu version 2.5.1 or to apply the appropriate patch available at the link provided in the references.",Apache,Apache Shenyu,8.8,HIGH,0.0031999999191612005,false,,false,false,false,,,false,false,,2023-02-15T09:38:55.301Z,0
CVE-2022-37435,https://securityvulnerability.io/vulnerability/CVE-2022-37435,Apache ShenYu Admin Improper Privilege Management,"Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege administrator's passwords. This issue affects Apache ShenYu 2.4.2 and 2.4.3.",Apache,Apache Shenyu,8.8,HIGH,0.0011099999537691474,false,,false,false,false,,,false,false,,2022-09-01T14:00:14.000Z,0
CVE-2022-26650,https://securityvulnerability.io/vulnerability/CVE-2022-26650,Apache ShenYu (incubating) Regular expression denial of service,"In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.",Apache,Apache Shenyu (incubating),7.5,HIGH,0.0017999999690800905,false,,false,false,false,,,false,false,,2022-05-17T08:05:10.000Z,0
CVE-2022-23945,https://securityvulnerability.io/vulnerability/CVE-2022-23945,Apache ShenYu missing authentication allows gateway registration,Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.,Apache,Apache Shenyu (incubating),7.5,HIGH,0.0017300000181421638,false,,false,false,false,,,false,false,,2022-01-25T13:00:25.000Z,0
CVE-2022-23944,https://securityvulnerability.io/vulnerability/CVE-2022-23944,Apache ShenYu 2.4.1 Improper access control,User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.,Apache,Apache Shenyu (incubating),9.1,CRITICAL,0.5909299850463867,false,,false,false,false,,,false,false,,2022-01-25T13:00:24.000Z,0
CVE-2022-23223,https://securityvulnerability.io/vulnerability/CVE-2022-23223,Apache ShenYu Password leakage,"On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.",Apache,Apache Shenyu (incubating),7.5,HIGH,0.0018700000364333391,false,,false,false,false,,,false,false,,2022-01-25T13:00:22.000Z,0
CVE-2021-45029,https://securityvulnerability.io/vulnerability/CVE-2021-45029,Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection,Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.,Apache,Apache Shenyu (incubating),9.8,CRITICAL,0.004120000172406435,false,,false,false,false,,,false,false,,2022-01-25T13:00:21.000Z,0
CVE-2021-37580,https://securityvulnerability.io/vulnerability/CVE-2021-37580,Apache ShenYu Admin bypass JWT authentication,A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0,Apache,Apache Shenyu Admin,9.8,CRITICAL,0.7434499859809875,false,,false,false,true,2023-10-10T08:41:54.000Z,true,false,false,,2021-11-16T09:35:11.000Z,0