What’s Vulnerable › Vulnerabilities

CVE-2022-23223: Apache ShenYu Password leakage

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-01-25 · updated 2026-06-17
• Weakness: CWE-522

Description

On Apache ShenYu versions 2.4.0 and 2.4.1, and endpoint existed that disclosed the passwords of all users. Users are recommended to upgrade to version 2.4.2 or later.

Affected products

• Apache Software Foundation Apache ShenYu (incubating): 2.4.0, 2.4.1

References

• http://www.openwall.com/lists/oss-security/2022/01/25/7
• http://www.openwall.com/lists/oss-security/2022/01/26/4
• https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s
• http://www.openwall.com/lists/oss-security/2022/01/25/7
• http://www.openwall.com/lists/oss-security/2022/01/26/4
• https://lists.apache.org/thread/q2gg6ny6lpkph7nkrvjzqdvqpm805v8s

Get alerted when CVE-2022-23223 or the next vulnerability affects your stack