PkgSeer

Vulnerability GHSA-c6r4-qjmw-cvj2

Medium Risk

5 months ago

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1

Summary

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Details

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute.

This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1.

Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue.

In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Low Risk

4 months ago

Apache Shiro's "remember me" cookie age is not verified on the server.

1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff

Medium Risk

2 years ago

Open redirect in Apache Shiro

1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h

Critical

3 years ago

Path Traversal in Apache Shiro

1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg

High Risk

4 years ago

Improper Access Control in Apache Shiro

1.0.0-incubating - 1.3.1 GHSA-4q2v-j639-cp7p

Critical

4 years ago

Authentication bypass in Apache Shiro

1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj

View all vulnerabilities for these packages

Impacted packages

org.apache.shiro:shiro-web

Timeline

Published

5 months ago

Fixed (2.2.0)

Unknown

Last Modified

4 months ago