CVE-2010-3863: Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote…

PriorityP351medium5CVSS 2.0

AVNACLAuNCPINAN

EXPLOIT

EPSS

54.80%

98.9th percentile

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apache	shiro	<= 1.0.0	—
debian	shiro	—	—
jsecurity	jsecurity	—	—

Detection & IOCsextracted from sources · hover to see the quote

url/./account/index.jsp↗

commandGET /./account/index.jsp HTTP/1.1↗

→Look for URI paths containing non-canonicalized sequences (e.g., /./) in HTTP requests targeting protected resources, which may indicate an attempt to bypass Shiro/JSecurity access control rules defined in shiro.ini. ↗
→Alert on HTTP GET requests where the URI path contains path traversal sequences such as /./ before a protected resource path segment. ↗

·Affected versions are Apache Shiro before 1.1.0 and JSecurity 0.9.x; access control bypass only occurs when URI path canonicalization is absent in the framework's filter chain evaluation against shiro.ini. ↗

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

vendor_debian5.0LOW

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.