Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.

CVE-2023-34478

Summary

Apache Shiro, a powerful and flexible open-source security framework, is susceptible to a path traversal vulnerability prior to versions 1.12.0 and 2.0.0-alpha-3. When integrated with APIs or web frameworks that handle non-normalized requests, this vulnerability could allow attackers to bypass authentication mechanisms. Users are highly encouraged to update to the latest versions to mitigate the risks associated with this vulnerability.

References