GHSA-vpfp-5gwq-g533

Improper Authentication in Apache ShenYu Admin

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-37580

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.shenyu:shenyu-admin	>= 2.3.0, < 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-37580 advisory
https://github.com/apache/shenyu/commit/f78adb26926ba53b4ec5c21f2cf7e931461d601d web
https://github.com/apache/shenyu package
https://github.com/apache/shenyu/releases/tag/v2.4.1 web
https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb web
http://www.openwall.com/lists/oss-security/2021/11/16/1 web