CVE-2023-22602 Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot 2.6 default to Ant sty...

CVE-2023-22602

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot 2.6 default to Ant sty...

CVE-2023-22602 Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot 2.6 default to Ant sty...

CVE-2023-22602 Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot 2.6 default to Ant sty...

CVE-2023-22602

The CVE-2023-22602 issue affects Apache Shiro before 1.11.0 when used with Spring Boot 2.6+ and can allow an authentication bypass via a specially crafted HTTP request. The bypass arises because Shiro and Spring Boot may use different Ant-style pattern matching, causing access controls to be impr...

CVE-2023-22602: Interpretation Conflict

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot 2.6 default to Ant sty...

Apache Shiro security vulnerabilities

Apache Shiro is a suite of Java security frameworks for performing authentication, authorization, encryption, and session management from the Apache Foundation USA. A security vulnerability exists in Apache Shiro versions prior to 1.11.0, which stems from a specially crafted HTTP request that cou...

PT-2023-8779 · Apache +2 · Apache Shiro +2

Name of the Vulnerable Software and Affected Versions: Apache Shiro versions prior to 1.11.0 Spring Boot versions 2.6+ Description: The issue is related to a conflict of interpretations between Apache Shiro and Spring Boot, which can be exploited by a remote attacker using a specially crafted HTT...

favorites-web Cross-site scripting vulnerabilities

Favorites-web Cloud Favorites is an open source website built with Spring Boot by the individual developer Pure Smile ityouknow. A cross-site scripting vulnerability exists in favorites-web, which stems from some unknown functionality in its Comment Handler component that allows an attacker to...

This Week in Spring - January 9th, 2023

Hi, Spring fans! As I write this Im on a plane winging my way to Helsinki, Finland. A new year and new journeys begin. Its going to be cold there. Wish me luck! Do you know what always warms me up? The thrill of learning. And this weeks no different. This week weve got some good stuff line up so...

This Week in Spring - Happy New Year 2023 edition - December 27th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Its 27 December as I write this and - being honest - I couldnt be happier. Its raining outside. Im in a warm cozy office. Good music is playing. People are asleep in my home. I can hear the raindrops and wind outside the...

kkFileView cross-site scripting vulnerability (CNVD-2023-00013)

kkFileView is China's Keking Technology Keking company's a Spring-Boot to create a file document online preview project . A cross-site scripting vulnerability exists in kkFileView, which stems from the setWatermarkAttribute function in the /picturesPreview file that allows an attacker to implemen...

kkFileView Cross-Site Script Vulnerability

kkFileView is China's Keking Technology Keking company's a Spring-Boot to create a file document online preview project . A cross-site scripting vulnerability exists in kkFileView, which stems from the setWatermarkAttribute function in the /picturesPreview file that allows an attacker to implemen...

Spring Boot 3.0.1 available now

On behalf of the team and everyone who has contributed, Im happy to announce that Spring Boot 3.0.1 has been released and is now available from Maven Central. This release includes 54 bug fixes, documentation improvements, and dependency upgrades. Thanks to all those who have contributed with iss...

Moderate: Red Hat Security Advisory: Red Hat support for Spring Boot 2.7.2 update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat support for Spring Boot provides an application platform that reduces the complexity of developing and operating applications monoliths and microservices for OpenShift as a containerized platform. This release of Red H...

cn.com.pism.gfd:gofastdfs-spring-boot-autoconfigure (>=0.0.1, <=0.0.5), cn.com.pism.gfd:gofastdfs-spring-boot-starter (>=0.0.1, <=0.0.5) +244 more potentially affected by CVE-2022-45690 via cn.hutool:hutool-json (>=5.0.0, <=5.8.10)

cn.hutool:hutool-json MAVEN version =5.0.0, =0.0.1, =0.0.1, =1.31.0.rc, =1.31.0, =2.0.0, =5.0.0, =5.0.0, =5.0.0, =5.7.0, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =2.0.2, =2.0.6 and more Source cves: CVE-2022-45690 Source advisory: GHSA-WHGH-G24C-3J5Q...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2022-45688 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2022-45689 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

cn.hutool:hutool-dfa (4.0.9), cn.hutool:hutool-http (4.0.9) +2 more potentially affected by CVE-2022-45690 via cn.hutool:hutool-json (4.0.9)

cn.hutool:hutool-json MAVEN version 4.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.0.9 - cn.hutool:hutool-http 4.0.9 - cn.virens:virens-util =1.0.7, =1.1.1 -...

This Week in Spring - December 13th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I truly, absolutely, can not believe that were nearly done with the year already! Have you made your new years resolutions? Submitted your expense reports? Its that time of the year when Im going to start focusing on staying...