Vulnerability GHSA-45x9-q6vj-cqgq
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 years ago
October 12, 2022 at 12:00 PM UTC
Apache Shiro Authentication Bypass vulnerability
1.0.0-incubating - 1.9.1
1.0.0-incubating - 1.9.1
Summary
Apache Shiro Authentication Bypass vulnerability
Details
Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
High Risk
4 months ago
Apache Shiro: LDAP DN Injection in DefaultLdapRealm
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8
1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8
Medium Risk
5 months ago
Apache Shiro has a session fixation vulnerability
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx
Low Risk
8 months ago
Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9
Medium Risk
2 years ago
Apache Shiro vulnerable to path traversal
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc
Impacted packages
Timeline
Published
4 years ago
October 12, 2022 at 12:00 PM UTC
Fixed (1.10.0)
Unknown
Unknown
Last Modified
2 years ago
February 16, 2024 at 07:57 AM UTC