Apache

Shiro

17 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.5

CVE-2023-46749

  • EPSS 0.2%
  • Published 15.01.2024 10:15:26
  • Last modified 03.06.2025 14:15:29

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `bloc...

6.1

CVE-2023-46750

  • EPSS 0.17%
  • Published 14.12.2023 09:15:42
  • Last modified 22.05.2025 18:15:27

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

9.8

CVE-2023-34478

  • EPSS 0.04%
  • Published 24.07.2023 19:15:10
  • Last modified 13.02.2025 17:16:38

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigatio...

7.5

CVE-2023-22602

  • EPSS 0.14%
  • Published 14.01.2023 10:15:09
  • Last modified 21.11.2024 07:45:02

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. B...

9.8

CVE-2022-40664

  • EPSS 0.49%
  • Published 12.10.2022 07:15:09
  • Last modified 15.05.2025 15:16:02

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

9.8

CVE-2022-32532

  • EPSS 79.03%
  • Published 29.06.2022 00:15:10
  • Last modified 21.11.2024 07:06:34

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

9.8

CVE-2021-41303

  • EPSS 48.73%
  • Published 17.09.2021 09:15:09
  • Last modified 21.11.2024 06:26:00

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

9.8

CVE-2020-17523

  • EPSS 88.77%
  • Published 03.02.2021 17:15:13
  • Last modified 21.11.2024 05:08:17

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

9.8

CVE-2020-17510

  • EPSS 1.02%
  • Published 05.11.2020 21:15:12
  • Last modified 21.11.2024 05:08:15

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

7.5

CVE-2020-13933

  • EPSS 69.49%
  • Published 17.08.2020 21:15:11
  • Last modified 21.11.2024 05:02:10

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.