Description
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages4 packages
▶Debianshiro< 1.3.2-4+deb11u1+2 🔴Vulnerability Details
4GHSAImproper Authentication in Apache Shiro↗2021-05-07 OSVImproper Authentication in Apache Shiro↗2021-05-07 CVEListCVE-2020-11989: Apache Shiro before 1↗2020-06-22 OSVCVE-2020-11989: Apache Shiro before 1↗2020-06-22 📋Vendor Advisories
3UbuntuApache Shiro vulnerabilities↗2021-02-18 Red Hatshiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass↗2020-06-22 DebianCVE-2020-11989: shiro - Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controlle...↗2020 💬Community
2BugzillaCVE-2020-11989 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass [fedora-all]↗2020-06-23 BugzillaCVE-2020-11989 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass↗2020-06-23