GitHub Advisoryadvisory · Maven

GHSA-4cf5-xmhp-3xj7 Improper Authorization in Apache Shiro

CRITICAL Published 2022-06-30 Modified 2022-07-11 Official page ↗
Aliases
CVE-2022-32532
Ecosystem
Maven
Packages
org.apache.shiro:shiro-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-285, CWE-863
Reviewed
2022-07-06

Affected packages

• Maven org.apache.shiro:shiro-core: < 1.9.1 → fixed in 1.9.1

Description

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Related

Alias · CVE (1)

  • CVE-2022-32532 Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-863 Incorrect Authorization weakness

References