logo
DATABASE RESOURCES PRICING ABOUT US

Apache Shiro URI Path Security Directory Traversal Information Disclosure

Description

The version of the Apache Shiro open source security framework running on the remote web server is affected by an error in the path-based filter chain mechanism due to a failure to properly normalize URI paths before comparing them with entries in the shiro.ini file. An unauthenticated, remote attacker can exploit this, via a crafted request using directory traversal, to bypass intended access restrictions, resulting in the disclosure of sensitive information.


Related