Vulnerability GHSA-pmhc-2g4f-85cg

Critical

3 years ago

Path Traversal in Apache Shiro

1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2

Summary

Path Traversal in Apache Shiro

Details

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.

Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Low Risk

4 months ago

Apache Shiro's "remember me" cookie age is not verified on the server.

1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff

Medium Risk

5 months ago

Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2

Medium Risk

2 years ago

Open redirect in Apache Shiro

1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h

High Risk

4 years ago

Improper Access Control in Apache Shiro

1.0.0-incubating - 1.3.1 GHSA-4q2v-j639-cp7p

Critical

4 years ago

Authentication bypass in Apache Shiro

1.0.0-incubating - 1.7.0 GHSA-v98j-7crc-wvrj

View all vulnerabilities for these packages

Impacted packages

org.apache.shiro:shiro-web

Timeline

Published

3 years ago

Fixed (1.12.0)

Unknown

Fixed (2.0.0-alpha-3)

Unknown

Last Modified

1 year ago