CVE-2010-3863 Apache Shiro Path Traversal vulnerability
MediumCVSS 5.0
EPSS 54.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.shiro/shiro-root(Maven) | < 1.1.0 | 1.1.0 |
| org.apache.shiro/shiro-root(Maven) | = 1.0.0-incubating | No fix listed |
| apache shiro | <= 1.0.0 | No fix listed |
| jsecurity | = 0.9.0 | No fix listed |
References
- Debian Security Tracker CVE-2010-3863 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- shiro-filters-security-bypass(62959) vdb-entry
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- 20101102 CVE-2010-3863: Apache Shiro information disclosure vulnerability exploit mailing-list
- github.com
- 69067 vdb-entry
- 41989 third-party-advisory vendor-advisory
- 20101103 CVE-2010-3863: Apache Shiro information disclosure vulnerability mailing-list
- 44616 exploit vdb-entry
- ADV-2010-2888 vdb-entry