CVEvulnerability
CVE-2010-3863
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2010-11-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-22
Description
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Affected configurations
• apache shiro (<= 1.0.0)
• jsecurity jsecurity 0.9.0
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html Exploit
- http://osvdb.org/69067 osvdb.org
- http://secunia.com/advisories/41989 Vendor Advisory
- http://www.securityfocus.com/archive/1/514616/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/44616 Exploit
- http://www.vupen.com/english/advisories/2010/2888 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62959 exchange.xforce.ibmcloud.com
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html Exploit
- http://osvdb.org/69067 osvdb.org
- http://secunia.com/advisories/41989 Vendor Advisory
- http://www.securityfocus.com/archive/1/514616/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/44616 Exploit
- http://www.vupen.com/english/advisories/2010/2888 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62959 exchange.xforce.ibmcloud.com