PkgSeer

Vulnerability GHSA-m8g6-vrr2-x7ff

Low Risk

4 months ago

Apache Shiro's "remember me" cookie age is not verified on the server.

1.2.4 - 3.0.0-alpha-1

Summary

Apache Shiro's "remember me" cookie age is not verified on the server.

Details

"Remember me" cookie age is not verified on the server. This potentially allows an attacker to intercept a valid cookie and reuse it indefinitely, even after the configured expiration time has passed. This issue affects all Apache Shiro versions from 1.2.4 through 2.x, and 3.0.0-alpha-1, only when RememberMe functionality is enabled.

Upgrade to version 3.0.0 or later, which fixes the issue.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Apache Shiro: LDAP DN Injection in DefaultLdapRealm

1.0.0-incubating - 2.2.0 and 3.0.0-alpha-1 GHSA-x96m-rh44-vgv8

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2

Apache Shiro has a session fixation vulnerability

1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-fcvm-3cpj-f9qx

Apache Shiro Affected by an Observable Timing Discrepancy Vulnerability

1.0.0-incubating - 2.0.6 GHSA-c4qc-4q9p-m9q9

Apache Shiro vulnerable to path traversal

1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-jc7h-c423-mpjc

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

4 months ago

Fixed (3.0.0)

Unknown

Fixed (3.0.0)

Unknown

Last Modified

12 hours ago