CVE-2022-23223

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache ShenYu (incubating)	>= Apache ShenYu (incubating), < 2.4.2

References

http://www.openwall.com/lists/oss-security/2022/01/25/7Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/26/4Exploit, Mailing List, Patch, Third Party Advisory
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8sMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2022/01/25/7Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2022/01/26/4Exploit, Mailing List, Patch, Third Party Advisory
https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8sMailing List, Vendor Advisory

Timeline

Published: Jan 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-232279.8NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users CVE-2022-232287.5Pexip Infinity before 27.0 has improper WebRTC input validation. An unauthenticated remote attacker can use excessive resources, temporarily CVE-2022-23238.8Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in CVE-2022-232324.9StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co CVE-2022-232337.5StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0 are susceptible to a vulnerability which when successfully exploited co CVE-2022-232345.5SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext H CVE-2022-232355.3Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.10P1 are susceptible to a vulnerability which CVE-2022-232364.4E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessible CVE-2022-232376.1E-Series SANtricity OS Controller Software 11.x versions through 11.70.2 are vulnerable to host header injection attacks that could allow an CVE-2022-232386.5Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less CVE-2022-232394.8Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which CVE-2022-23247.5Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service i