GHSA-jc7h-c423-mpjc
Apache Shiro vulnerable to path traversal
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-46749
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Description
Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.apache.shiro:shiro-core | introduced 0, fixed 1.13.0 |
| Maven · org.apache.shiro:shiro-core | introduced 2.0.0alpha1, fixed 2.0.0-alpha4 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-46749 ADVISORY
- https://lists.apache.org/thread/mdv7ftz7k4488rzloxo2fb0p9shnp9wm WEB
- https://security.netapp.com/advisory/ntap-20241108-0002 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |