~ / search / GHSA-f6jp-j6w3-w9hm

GHSA-f6jp-j6w3-w9hm

Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-41303

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.shiro:shiro-core < 1.8.0 1.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

References

External links from the advisory. They lead to third-party sites.