CVE-2023-34478 Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.

🗓️ 24 Jul 2023 18:24:45Reported by GoogleType

osv

osv🔗 osv.dev👁 27 Views

Apache Shiro path traversal authentication bypas

Reporter	Title	Published	Views	Family All 40
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Apache Axis, Apache Shiro and SnakeYAML affect IBM WebSphere Service Registry and Repository	5 Mar 202416:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data 4.8.0 has addressed security vulnerabilities	29 Nov 202322:26	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities addressed in Cloudera Data Platform 7.1.9 HF2	26 Mar 202503:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace has addressed multiple vulnerabilities	27 Mar 202420:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable directory traversal due to Apache Shiro (CVE-2023-34478)	12 Mar 202417:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Global Availability Mailbox is affected by a vulnerability in Cassandra Reaper	17 Mar 202507:47	–	ibm
BDU FSTEC	The vulnerability of the Apache Shiro framework’s interface, which allows attackers to circumvent security restrictions	1 Aug 202300:00	–	bdu_fstec
Broadcom	Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack (CVE-2023-34478)	16 Apr 202400:00	–	broadcom
Broadcom	Security update provided in Brocade SANnav 2.3.0a and 2.3.1	30 Apr 202400:00	–	broadcom
Circl	CVE-2023-34478	24 Jul 202322:26	–	circl

Source	Link
openwall	www.openwall.com/lists/oss-security/2023/07/24/4
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34478.json
lists	www.lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-34478
security	www.security.netapp.com/advisory/ntap-20230915-0005/

15 Jul 2026 01:49Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.02057

apache shiro path traversal authentication bypass update vulnerability