GitHub Advisoryadvisory · Maven

GHSA-jc7h-c423-mpjc Apache Shiro vulnerable to path traversal

MEDIUM Published 2024-01-15 Modified 2025-11-04 Official page ↗
Aliases
CVE-2023-46749
Ecosystem
Maven
Packages
org.apache.shiro:shiro-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2024-01-16

Affected packages

• Maven org.apache.shiro:shiro-core: < 1.13.0 → fixed in 1.13.0 • Maven org.apache.shiro:shiro-core: >= 2.0.0alpha1, < 2.0.0-alpha4 → fixed in 2.0.0-alpha4

Description

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

Related

Alias · CVE (1)

  • CVE-2023-46749 Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References