apache__shiro_CVE-2023-34478_1-11-0

Apache Shiro Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable directory traversal due to Apache Shiro (CVE-2023-34478)

Summary IBM Sterling Partner Engagement Manager uses Apache Shiro. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34478 DESCRIPTION: Apache Shiro could allow a remote authenticated attacker to traverse directories on the system, cause...

VulnCheck KEV: CVE-2023-34478

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1660 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=1.11.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.2, =0.0.21, =0.0.2, =0.0.1, =1.0.2, =1.0.0, =1.0.0, =5.2.1, =1.0.0, =0.1, =0.1, =0.2 and more Source cves: CVE-2023-34478 Source advisory: GHSA-PMHC-2G4F-85CG...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), br.eti.arthurgregorio:shiro-ee (>=1.0.0, <=1.5.1) +1660 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=1.0.0-incubating, <=1.11.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =4.0.0-beta-1, =1.0.0, =0.0.2, =0.0.21, =0.0.2, =0.0.1, =1.0.2, =1.0.0, =1.0.0, =5.2.1, =1.0.0, =0.1, =0.1, =0.2 and more Source cves: CVE-2023-34478 Source advisory: MEND:CVE-2023-34478...

CVE-2023-34478

Apache Shiro versions prior to 1.12.0 or 2.0.0-alpha-3 are susceptible to a path traversal vulnerability. The root cause is a failure to properly filter special elements in resource or file paths, which can lead to an authentication bypass when the framework is integrated with APIs or web framewo...