Vulnerability GHSA-4q2v-j639-cp7p
High Risk
HIGH RISK
CVSS Score: 7.5
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
4 years ago
May 14, 2022 at 02:46 AM UTC
Improper Access Control in Apache Shiro
1.0.0-incubating - 1.3.1
1.0.0-incubating - 1.3.1
Summary
Improper Access Control in Apache Shiro
Details
Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
Medium Risk
5 months ago
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
Medium Risk
2 years ago
Open redirect in Apache Shiro
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h
Critical
3 years ago
Path Traversal in Apache Shiro
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
Critical
4 years ago
Authentication bypass in Apache Shiro
1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj
1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj
Impacted packages
Timeline
Published
4 years ago
May 14, 2022 at 02:46 AM UTC
Fixed (1.3.2)
Unknown
Unknown
Fixed (1.3.2)
Unknown
Unknown
Last Modified
2 years ago
November 08, 2023 at 03:58 AM UTC