CVE-2023-25753CWE-918

CVE-2023-25753: falha em Apache ShenYu

Server-Side Request Forgery in Apache ShenYu

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache ShenYu+ Monitorar org.apache.shenyu:shenyu-common

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.1%
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch  https://github.com/apache/shenyu/pull/4776  .
Produtos afetados
Apache Software Foundation · Apache ShenYu
CVEs relacionadas — Apache ShenYu

No mesmo produto, das mais perigosas para as menos.

CVE-2022-37435—Apache ShenYu Admin Improper Privilege ManagementEPSS 1.3%CVE-2022-42735HIGHApache ShenYu Admin ultra viresEPSS 1.2%