apache__shiro_CVE-2023-34478_1-11-0

Apache Shiro Apache Shiro 是一个强大且易用的 Java 安全框架，提供身份验证、授权、加密和会话管理。借助 Shiro 易于理解的 API，您可以快速轻松地保护任何应用程序——从最小的移动应用程序到最大的 Web 和企业应用程序。 文档和示例 http://shiro.apache.org 教程 10 分钟教程 Web 应用程序 许可证 Apache License, Version 2.0...

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable directory traversal due to Apache Shiro (CVE-2023-34478)

Summary IBM Sterling Partner Engagement Manager uses Apache Shiro. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34478 DESCRIPTION: Apache Shiro could allow a remote authenticated attacker to traverse directories on the system, cause...

VulnCheck KEV: CVE-2023-34478

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha...

CVE-2023-34478

Apache Shiro versions prior to 1.12.0 or 2.0.0-alpha-3 are susceptible to a path traversal vulnerability. The root cause is a failure to properly filter special elements in resource or file paths, which can lead to an authentication bypass when the framework is integrated with APIs or web framewo...