Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable directory traversal due to Apache Shiro (CVE-2023-34478)

Summary IBM Sterling Partner Engagement Manager uses Apache Shiro. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-34478 DESCRIPTION: Apache Shiro could allow a remote authenticated attacker to traverse directories on the system, cause...

VulnCheck KEV: CVE-2023-34478

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or...

cloud.opencode.base:opencode-base-token (=1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0 <=2.1.0) +11 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1 <=2.0.0-alpha-2)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-2 Source cves: CVE-2023-34478 Source advisory: OSV:GHSA-PMHC-2G4F-85CG...

ca.ibodrov.concord:testcontainers-concord-core (>=2.0.0 <=2.0.2), ca.ibodrov.mica:mica-concord-server-plugin (>=0.0.2 <=0.0.21) +257 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=1.0.0-incubating <=1.11.0)

org.apache.shiro:shiro-web MAVEN version =1.0.0-incubating, =2.0.0, =0.0.2, =2.2.0, =2.2.0, =2.2.0, =2.8.0, =2.8.0, =2.8.0, =2.8.0, =3.0.0, =2.8.0, =5.0, =5.0, =5.5 and more Source cves: CVE-2023-34478 Source advisory: OSV:GHSA-PMHC-2G4F-85CG...

CVE-2023-34478

Apache Shiro prior to 1.12.0 or 2.0.0-alpha-3 is vulnerable to a path traversal issue that can enable an authentication bypass when used with APIs or web frameworks that route requests based on non-normalized paths. Affected versions include Shiro before 1.12.0 and 2.0.0-alpha-3, with the mitigat...