org.apache.shenyu:shenyu-admin@2.4.1 vulnerabilities
latest version
2.7.0
latest non vulnerable version
first published
3 years ago
latest version published
9 days ago
licenses detected
- [2.4.0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.shenyu:shenyu-admin package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the Note: This is only exploitable if the HTTP method, cookies, IP address, and headers are under the attacker's control. How to fix Server-side Request Forgery (SSRF)? Upgrade | [,2.6.0) |
Affected versions of this package are vulnerable to Improper Privilege Management by allowing low-privilege low-level administrators to create users with higher privileges than their own. How to fix Improper Privilege Management? Upgrade | [,2.5.1) |
Affected versions of this package are vulnerable to Access Restriction Bypass due to missing authentication on ShenYu Admin, which allows leakage of user passwords in HTTP responses. How to fix Access Restriction Bypass? Upgrade | [,2.4.2) |
Affected versions of this package are vulnerable to Arbitrary Code Execution via the How to fix Arbitrary Code Execution? Upgrade | [,2.4.2) |
Affected versions of this package are vulnerable to MIssing Authorization. User can access /plugin api without authentication from the whitelist interface of Shenyu admin. How to fix MIssing Authorization? Upgrade | [,2.4.2) |
Affected versions of this package are vulnerable to Access Restriction Bypass via incorrect use of JWT in ShenyuAdminBootstrap which allows an attacker to bypass authentication. How to fix Access Restriction Bypass? Upgrade | [2.3.0,2.4.2) |