Lookup for vulnerable packages by Package URL.
| Purl | pkg:maven/org.apache.shenyu/shenyu-common@2.4.1 |
| Type | maven |
| Namespace | org.apache.shenyu |
| Name | shenyu-common |
| Version | 2.4.1 |
| Qualifiers |
|
| Subpath | |
| Is_vulnerable | true |
| Next_non_vulnerable_version | 2.6.0 |
| Latest_non_vulnerable_version | 2.6.0 |
| Affected_by_vulnerabilities |
| 0 |
|
| 1 |
| url |
VCID-jfjg-rke2-1ugq |
| vulnerability_id |
VCID-jfjg-rke2-1ugq |
| summary |
Missing authentication in ShenYu
Missing authentication on ShenYu Admin when they register by HTTP. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23945 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.73002 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.73041 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.73017 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.7303 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.73047 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00728 |
| scoring_system |
epss |
| scoring_elements |
0.7304 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23945 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-23945, GHSA-7rjp-fgwj-47rw
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jfjg-rke2-1ugq |
|
| 2 |
| url |
VCID-jwcu-3aje-mqfb |
| vulnerability_id |
VCID-jwcu-3aje-mqfb |
| summary |
Improper Control of Generation of Code ('Code Injection')
Shenyu is vulnerable to Groovy Code Injection & SpEL Injection which can lead to Remote Code Execution. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45029 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93342 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93359 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93351 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93354 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93353 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.10389 |
| scoring_system |
epss |
| scoring_elements |
0.93352 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-45029 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2021-45029, GHSA-gh38-x2wm-xmc8
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jwcu-3aje-mqfb |
|
| 3 |
| url |
VCID-rqw7-kkzg-dkdz |
| vulnerability_id |
VCID-rqw7-kkzg-dkdz |
| summary |
Password exposure in ShenYu
The HTTP response will disclose the user password. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23223 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04553 |
| scoring_system |
epss |
| scoring_elements |
0.89393 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.04553 |
| scoring_system |
epss |
| scoring_elements |
0.89411 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.04553 |
| scoring_system |
epss |
| scoring_elements |
0.89376 |
| published_at |
2026-06-04T12:55:00Z |
|
| 3 |
| value |
0.04553 |
| scoring_system |
epss |
| scoring_elements |
0.89395 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.04553 |
| scoring_system |
epss |
| scoring_elements |
0.89394 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-23223 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2022-23223, GHSA-7wq4-89xx-g62j
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rqw7-kkzg-dkdz |
|
| 4 |
| url |
VCID-u8ap-uw42-a7h7 |
| vulnerability_id |
VCID-u8ap-uw42-a7h7 |
| summary |
Server-Side Request Forgery (SSRF)
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter.
Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing.
This issue affects Apache ShenYu: 2.5.1.
Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 . |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-25753 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73466 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73426 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73463 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73468 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73455 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00746 |
| scoring_system |
epss |
| scoring_elements |
0.73442 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-25753 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2023-25753, GHSA-7w8v-5fcq-pvqw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u8ap-uw42-a7h7 |
|
|
| Fixing_vulnerabilities |
|
| Risk_score | 10.0 |
| Resource_url | http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.shenyu/shenyu-common@2.4.1 |