Skip to content
OpenAdvisories

Package · Maven

org.apache.shiro:shiro-root

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2023-22602

    Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

    When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro …

    Apache Software Foundation Apache Shiro shiro org.apache.shiro:shiro-root Debian Maven
  • Medium —
    CVE-2010-3863 Public exploit EPSS 55%

    Apache Shiro Path Traversal vulnerability

    Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./accou…

    org.apache.shiro:shiro-root Maven