Vulnerability GHSA-jc7h-c423-mpjc

Medium Risk

2 years ago

Apache Shiro vulnerable to path traversal

1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3

Summary

Apache Shiro vulnerable to path traversal

Details

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Low Risk

4 months ago

Apache Shiro's "remember me" cookie age is not verified on the server.

1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff

High Risk

4 months ago

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8

Medium Risk

5 months ago

Apache Shiro has a session fixation vulnerability

1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx

Low Risk

8 months ago

Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability

1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9

Critical

4 years ago

Apache Shiro Authentication Bypass vulnerability

1.0.0-incubating - 1.9.1 GHSA-45x9-q6vj-cqgq

View all vulnerabilities for these packages

Impacted packages

org.apache.shiro:shiro-core

Timeline

Published

2 years ago

Fixed (1.13.0)

Unknown

Last Modified

12 months ago