GHSA-hhw5-c326-822h

Open redirect in Apache Shiro

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-46750

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.shiro:shiro-web	< 1.13.0	1.13.0
Maven	org.apache.shiro:shiro-web	>= 2.0.0-alpha-1, < 2.0.0-alpha-4	2.0.0-alpha-4

Details

As written in the advisory (Markdown source, shown as plain text).

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-46750 advisory
https://github.com/apache/shiro/commit/3b80f5c8e5a95ba31e92e4825ecc0ba3148b555a web
https://github.com/apache/shiro/commit/8400d08d5eac0bc4fae99d28c5adc82dd8a86eda web
https://github.com/apache/shiro package
https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9 web
https://security.netapp.com/advisory/ntap-20240808-0002 web
https://security.netapp.com/advisory/ntap-20241108-0002 web