Vulnerability · Published Jul 24, 2023 · Assigned by apache
CVE-2023-34478Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Critical 9.8
In plain English
A critical-severity path traversal in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2023-34478 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2023-34478 |
| Debian:14 | shiro | no fix listed | DEBIAN-CVE-2023-34478 |
| Maven | org.apache.shiro:shiro-web | 1.12.0 | GHSA-pmhc-2g4f-85cg |
| Maven | org.apache.shiro:shiro-web | 2.0.0-alpha-3 | GHSA-pmhc-2g4f-85cg |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2023-34478 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | 0 – before 1.12.00 – before 2.0.0-alpha-3 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H