Description
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High
Affected Packages5 packages
🔴Vulnerability Details
4OSVAuthentication bypass in Apache Shiro↗2022-02-09 GHSAAuthentication bypass in Apache Shiro↗2022-02-09 CVEListCVE-2020-17523: Apache Shiro before 1↗2021-02-03 OSVCVE-2020-17523: Apache Shiro before 1↗2021-02-03 📋Vendor Advisories
2Red Hatshiro: Authentication bypass through specially crafted HTTP request↗2021-01-01 DebianCVE-2020-17523: shiro - Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially craf...↗2020