GitHub Advisoryadvisory · Maven

GHSA-3jx9-mgwx-4q83 Apache Shiro Path Traversal vulnerability

MEDIUM Published 2022-05-14 Modified 2024-02-07 Official page ↗
Aliases
CVE-2010-3863
Ecosystem
Maven
Packages
org.apache.shiro:shiro-root
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-02-07

Affected packages

• Maven org.apache.shiro:shiro-root: < 1.1.0 → fixed in 1.1.0

Description

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

Related

Alias · CVE (1)

  • CVE-2010-3863 Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file,… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References