CVE-2010-3863

2010-11-0517:00:00

Debian Security Bug Tracker

security-tracker.debian.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.509 Medium

EPSS

Percentile

97.5%

JSON

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

OSVersionArchitecturePackageVersionFilename
Debian12allshiro< 1.3.2-5shiro_1.3.2-5_all.deb
Debian11allshiro< 1.3.2-4+deb11u1shiro_1.3.2-4+deb11u1_all.deb
Debian10allshiro< 1.3.2-4+deb10u1shiro_1.3.2-4+deb10u1_all.deb
Debian999allshiro< 1.3.2-5shiro_1.3.2-5_all.deb
Debian13allshiro< 1.3.2-5shiro_1.3.2-5_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	shiro	< 1.3.2-5	shiro_1.3.2-5_all.deb
Debian	11	all	shiro	< 1.3.2-4+deb11u1	shiro_1.3.2-4+deb11u1_all.deb
Debian	10	all	shiro	< 1.3.2-4+deb10u1	shiro_1.3.2-4+deb10u1_all.deb
Debian	999	all	shiro	< 1.3.2-5	shiro_1.3.2-5_all.deb
Debian	13	all	shiro	< 1.3.2-5	shiro_1.3.2-5_all.deb