How severe is CVE-2023-25753?

CVE-2023-25753 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2023-25753 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-25753?

CVE-2023-25753 affects Apache Shenyu. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-25753?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-25753 published?

CVE-2023-25753 was published on 2023-10-19 and last updated on 2026-06-17.

CVE-2023-25753

CVE-2023-25753 is a medium-severity vulnerability in Apache Shenyu with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-918.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (53rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-918
Affected product: Apache Shenyu
Published: 2023-10-19
Last modified: 2026-06-17

Description

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 .

Frequently asked questions

What is CVE-2023-25753?: There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 .
How severe is CVE-2023-25753?: CVE-2023-25753 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2023-25753 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (53rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-25753?: CVE-2023-25753 affects Apache Shenyu. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-25753?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-25753 published?: CVE-2023-25753 was published on 2023-10-19 and last updated on 2026-06-17.

References

https://lists.apache.org/thread/chprswxvb22z35vnoxv9tt3zknsm977d

Affected products (1)

cpe:2.3:a:apache:shenyu:2.5.1:*:*:*:*:*:*:*

More vulnerabilities in Apache Shenyu

CVE-2021-45029 — Critical (CVSS 9.8): Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and…
CVE-2021-37580 — Critical (CVSS 9.8): A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass…
CVE-2022-23944 — Critical (CVSS 9.1): User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVE-2022-42735 — High (CVSS 8.8): Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows…
CVE-2022-37435 — High (CVSS 8.8): Apache ShenYu Admin has insecure permissions, which may allow low-privilege administrators to modify high-privilege…
CVE-2022-26650 — High (CVSS 7.5): In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(),…

All CVEs affecting Apache Shenyu →

Other CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities

CVE-2026-47938 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF)…
CVE-2026-35431 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to…
CVE-2026-32186 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a…
CVE-2026-33107 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a…
CVE-2026-32871 — Critical (CVSS 10.0): FastMCP is a Pythonic way to build MCP servers and clients. Prior to version 3.2.0, the OpenAPIProvider in FastMCP…
CVE-2026-32169 — Critical (CVSS 10.0): Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a…

Browse all CWE-918 (Server-Side Request Forgery (SSRF)) vulnerabilities →