CVE-2023-34478
published 2023-07-24CVE-2023-34478: Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with…
critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | shiro | < 1.12.0 | 1.12.0 |
| apache | shiro | — | — |
| apache | shiro | >= 0 < 1.2.4-1ubuntu0.1~esm2 | 1.2.4-1ubuntu0.1~esm2 |
| apache | shiro | >= 0 < 1.3.2-5ubuntu0.24.04.1~esm1 | 1.3.2-5ubuntu0.24.04.1~esm1 |
| apache_software_foundation | apache_shiro | < 1.12.0 | 1.12.0 |
| apache_software_foundation | apache_shiro | < 2.0.0-alpha-3 | 2.0.0-alpha-3 |
| debian | shiro | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vulncheck9.8CRITICAL