Vulnerability GHSA-v98j-7crc-wvrj
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
4 years ago
February 09, 2022 at 10:03 PM UTC
Authentication bypass in Apache Shiro
1.0.0-incubating - 1.7.0
1.0.0-incubating - 1.7.0
Summary
Authentication bypass in Apache Shiro
Details
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
4 months ago
Apache Shiro's "remember me" cookie age is not verified on the server.
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
1.2.4 - 3.0.0-alpha-1 GHSA-m8g6-vrr2-x7ff
Medium Risk
5 months ago
Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
1.0.0-incubating - 2.1.0 and 3.0.0-alpha-1 GHSA-c6r4-qjmw-cvj2
Medium Risk
8 months ago
Apache Shiro has an Authentication Bypass
1.0.0-incubating - 2.0.6 GHSA-c244-p6m5-vqj6
1.0.0-incubating - 2.0.6 GHSA-c244-p6m5-vqj6
Medium Risk
2 years ago
Open redirect in Apache Shiro
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h
1.0.0-incubating - 1.12.0 and 2.0.0-alpha-1 - 2.0.0-alpha-3 GHSA-hhw5-c326-822h
Critical
3 years ago
Path Traversal in Apache Shiro
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
1.0.0-incubating - 1.11.0 and 2.0.0-alpha-1 - 2.0.0-alpha-2 GHSA-pmhc-2g4f-85cg
Impacted packages
Timeline
Published
4 years ago
February 09, 2022 at 10:03 PM UTC
Fixed (1.7.1)
Unknown
Unknown
Fixed (1.7.1)
Unknown
Unknown
Fixed (1.7.1)
Unknown
Unknown
Last Modified
2 years ago
November 08, 2023 at 04:02 AM UTC