CVE-2023-34478

2023-07-2419:15:10

CWE-22

[email protected]

web.nvd.nist.gov

2322

cve-2023-34478

apache shiro

path traversal

authentication bypass

security vulnerability

nvd

mitigation

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.5%

JSON

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.

Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+

Affected configurations

Vulners

NVD

Node

apacheshiroRange≤1.12.0

apacheshiroRange≤2.0.0-alpha-3

CPENameOperatorVersion
apache:shiroapache shirolt1.12.0
apache:shiroapache shiroeq2.0.0

CPE	Name	Operator	Version
apache:shiro	apache shiro	lt	1.12.0
apache:shiro	apache shiro	eq	2.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache Shiro",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.12.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "2.0.0-alpha-3",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]