Vulnerability · Published Jun 28, 2022 · Assigned by apache
CVE-2022-32532Authentication Bypass Vulnerability
Critical 9.8
In plain English
A critical-severity incorrect authorization in Apache Shiro from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.5% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)25.5%top 2.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | shiro | no fix listed | DEBIAN-CVE-2022-32532 |
| Debian:13 | shiro | no fix listed | DEBIAN-CVE-2022-32532 |
| Debian:14 | shiro | no fix listed | DEBIAN-CVE-2022-32532 |
| Maven | org.apache.shiro:shiro-core | 1.9.1 | GHSA-4cf5-xmhp-3xj7 |
| Ubuntu:22.04:LTS | shiro | no fix listed | UBUNTU-CVE-2022-32532 |
| Ubuntu:25.10 | shiro | no fix listed | UBUNTU-CVE-2022-32532 |
| Ubuntu:26.04:LTS | shiro | no fix listed | UBUNTU-CVE-2022-32532 |
| Ubuntu:26.10 | shiro | no fix listed | UBUNTU-CVE-2022-32532 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Shiro | Before 1.9.1 |
Weakness: CWE-863
References
- https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh x_refsource_MISC