Log in Start free

Vulnerability · Published Jun 22, 2020 · Assigned by apache

CVE-2020-11989

Critical 9.8

In plain English

A critical-severity security flaw in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 24.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)24.4%top 2.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC

Official description

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12shiro1.3.2-5DEBIAN-CVE-2020-11989
Debian:13shiro1.3.2-5DEBIAN-CVE-2020-11989
Debian:14shiro1.3.2-5DEBIAN-CVE-2020-11989
Mavenorg.apache.shiro:shiro-core1.5.3GHSA-72w9-fcj5-3fcg

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Shiro Apache Shiro 1.5.2 - 1.5.3

References