Path Traversal in Apache Shiro
Critical severity
GitHub Reviewed
Published
Jul 24, 2023
to the GitHub Advisory Database
•
Updated Nov 6, 2023
Package
Affected versions
< 1.12.0
>= 2.0.0-alpha-1, < 2.0.0-alpha-3
Patched versions
1.12.0
2.0.0-alpha-3
Description
Published by the National Vulnerability Database
Jul 24, 2023
Published to the GitHub Advisory Database
Jul 24, 2023
Reviewed
Jul 25, 2023
Last updated
Nov 6, 2023
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
References