Vulnerability GHSA-hhw5-c326-822h
Medium Risk
MEDIUM RISK
CVSS Score: 6.1
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
2 years ago
December 14, 2023 at 09:30 AM UTC
Open redirect in Apache Shiro
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3
Summary
Open redirect in Apache Shiro
Details
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
Medium Risk
5 months ago
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
Critical
3 years ago
Path Traversal in Apache Shiro
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
High Risk
4 years ago
Improper Access Control in Apache Shiro
1.0.0-incubating - 1.3.1 GHSA-4q2v-j639-cp7p
1.0.0-incubating - 1.3.1 GHSA-4q2v-j639-cp7p
Critical
4 years ago
Authentication bypass in Apache Shiro
1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj
1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj
Impacted packages
Timeline
Published
2 years ago
December 14, 2023 at 09:30 AM UTC
Fixed (1.13.0)
Unknown
Unknown
Fixed (2.0.0-alpha-4)
Unknown
Unknown
Last Modified
12 months ago
November 04, 2025 at 05:06 PM UTC