CVE-2022-42735: Privilege escalation in Apache ShenYu
Summary
CVE-2022-42735: Privilege escalation in Apache ShenYu. Affects org.apache.shenyu:shenyu-admin versions < 2.5.1. Fixed in 2.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ShenYu is an open-source project developed by the Apache Software Foundation. It is a service governance platform that provides dynamic routing, traffic management, and API gateway capabilities. ShenYu Admin is a component of ShenYu that allows administrators to manage users and their privileges. The vulnerability in Apache ShenYu allows low-privilege low-level administrators to create users with higher privileges than their own.
Vulnerability Detail
The vulnerability, identified as CVE-2022-42735, is an improper privilege management issue in Apache ShenYu. It arises from the ShenYu Admin component, which fails to enforce proper privilege checks when creating new users. This allows low-level administrators with limited privileges to create users with higher privileges, potentially leading to unauthorized access and privilege escalation. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
2.5.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, Apache ShenYu is affected by an improper privilege management vulnerability that allows low-privilege administrators to create users with higher privileges. To mitigate this vulnerability, it is advised to upgrade to Apache ShenYu 2.5.1 or apply the provided patch. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.shenyu:shenyu-admin →
FAQ
Apache ShenYu is an open-source service governance platform that provides dynamic routing, traffic management, and API gateway capabilities.
The vulnerability in Apache ShenYu is an improper privilege management issue that allows low-privilege administrators to create users with higher privileges than their own.
The vulnerability can lead to unauthorized access and privilege escalation, potentially compromising the security and integrity of the Apache ShenYu system.
To fix the vulnerability, it is recommended to upgrade to Apache ShenYu 2.5.1 or apply the provided patch from the GitHub pull request.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shenyu:shenyu-admin.
