Log in Start free

Vulnerability · Published Jan 15, 2024 · Assigned by apache

CVE-2023-46749Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Medium 6.5

In plain English

A medium-severity path traversal in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.2%top 32.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12shiro1.3.2-5DEBIAN-CVE-2023-46749
Debian:13shiro1.3.2-5DEBIAN-CVE-2023-46749
Debian:14shiro1.3.2-5DEBIAN-CVE-2023-46749
Mavenorg.apache.shiro:shiro-core1.13.0GHSA-jc7h-c423-mpjc
Mavenorg.apache.shiro:shiro-core2.0.0-alpha4GHSA-jc7h-c423-mpjc
Ubuntu:22.04:LTSshirono fix listedUBUNTU-CVE-2023-46749

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Shiro 0 – before 1.13.02.0.0-alpha-1 – before 2.0.0-alpha-4

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References