CVE-2020-13933

🗓️ 17 Aug 2020 20:19:53Reported by apacheType

cve🔗 web.nvd.nist.gov📰️ 8 Media mentions👁 167 Views🌐 WEB

Apache Shiro < 1.6.0 allows authentication bypass via crafted HTTP request

Reporter	Title	Published	Views	Family All 37
GithubExploit	Exploit for CVE-2020-13933	9 Sep 202010:20	–	githubexploit
GithubExploit	Exploit for CVE-2020-13933	9 Sep 202010:20	–	githubexploit
IBM Security Bulletins	Security Bulletin: Apache Shiro as used by Master Console is vulnerable to improper acceess control (CVE-2020-13933)	18 Nov 202021:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected by security vulnerabilities	24 Sep 202116:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics with Watson 11.2.1 has addressed multiple vulnerabilities	14 Oct 202121:21	–	ibm
Tenable Nessus	Apache Shiro < 1.6.0 Authentication Bypass	1 Jun 202200:00	–	nessus
Tenable Nessus	Debian DLA-2726-1 : shiro - LTS security update	5 Aug 202100:00	–	nessus
Tenable Nessus	Ubuntu 18.04 ESM / 20.04 LTS : Apache Shiro vulnerabilities (USN-6352-1)	7 Sep 202300:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2020-13933	27 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the Apache Shiro framework, related to defects in the authentication process, allows attackers to bypass existing security restrictions.	7 Sep 202300:00	–	bdu_fstec

NVD

Vulners

Node

apache shiroRange<1.6.0

Node

debian debian_linuxMatch9.0

[
  {
    "product": "Apache Shiro",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Apache Shiro before version 1.6.0"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r4506cedc401d6b8de83787f8436aac83956e411d66848c84785db46d%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/r8097b81905f2a113ebdf925bcbc6d8c9d6863c807c9ee42e1e7c9293%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3E
lists	www.lists.debian.org/debian-lts-announce/2021/08/msg00002.html
lists	www.lists.apache.org/thread.html/r6ea0224c1971a91dc6ade1f22508119a9c3bd56cef656f0c44bbfabb%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/rb47d88af224e396ee34ffb88ee99fb6d04510de5722cf14b7137e6bc%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3E
lists	www.lists.apache.org/thread.html/r18b45d560d76c4260813c802771cc9678aa651fb8340e09366bfa198%40%3Cdev.geode.apache.org%3E
lists	www.lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f6430398959bc4%40%3Cdev.shiro.apache.org%3E

Parameter	Position	Path	Description	CWE
name	path	res/{name}	Accessing /res/{name} triggers identity verification (redirect to login).	CWE-287
name	path	res/%3bpoc	PoC using encoded semicolon to specify a resource, demonstrating that a resource name can bypass verification under PoC conditions.	CWE-287

17 Jun 2026 02:53Current

7.5High risk

Vulners AI Score7.5

CVSS 25

CVSS 3.17.5

EPSS0.48019