~ / search / GHSA-jc7h-c423-mpjc

GHSA-jc7h-c423-mpjc

Apache Shiro vulnerable to path traversal

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-46749

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.shiro:shiro-core < 1.13.0 1.13.0
Maven org.apache.shiro:shiro-core >= 2.0.0alpha1, < 2.0.0-alpha4 2.0.0-alpha4

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

References

External links from the advisory. They lead to third-party sites.