Vulnerability · Published Aug 17, 2020 · Assigned by apache
CVE-2020-13933
High 7.5
In plain English
A high-severity security flaw in Apache Shiro. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 44.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)44.4%top 1.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | 1.3.2-5 | DEBIAN-CVE-2020-13933 |
| Debian:13 | shiro | 1.3.2-5 | DEBIAN-CVE-2020-13933 |
| Debian:14 | shiro | 1.3.2-5 | DEBIAN-CVE-2020-13933 |
| Maven | org.apache.shiro:shiro-core | 1.6.0 | GHSA-2vgm-wxr3-6w2j |
| Ubuntu:22.04:LTS | shiro | 1.3.2-5 | UBUNTU-CVE-2020-13933 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Apache Shiro | Apache Shiro before version 1.6.0 |
References
- https://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3E x_refsource_MISC
- [geode-dev] 20200831 Proposal to bring GEODE-8456 (shiro upgrade) to support branches mailing-list, x_refsource_MLIST
- [geode-dev] 20200901 Re: Proposal to bring GEODE-8456 (shiro upgrade) to support branches mailing-list, x_refsource_MLIST
- [shiro-dev] 20200924 Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201004 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201217 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201219 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201220 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201221 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20201222 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20210130 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20210316 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20210331 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20210407 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [shiro-dev] 20210504 Re: Request for assistance to backport CVE-2020-13933 fix mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210802 [SECURITY] [DLA 2726-1] shiro security update mailing-list, x_refsource_MLIST