org.apache.shiro/shiro-root vulnerabilities

Latest org.apache.shiro/shiro-root CVEs

Newest publication first

1. CVE-2023-22602 Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request

   Published 2023-01-14

   High·CVSS 7.5 EPSS 1.6%

   When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6...

2. CVE-2010-3863 Apache Shiro Path Traversal vulnerability

   Published 2010-11-05

   Medium·CVSS 5.0 EPSS 54.5% Public exploit

   Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.