Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
CVE-2023-34478

9.8CRITICAL

Key Information:

Vendor

Apache
Status
Apache Shiro
Vendor
CVE Published:
24 July 2023

What is CVE-2023-34478?

Apache Shiro, a powerful and flexible open-source security framework, is susceptible to a path traversal vulnerability prior to versions 1.12.0 and 2.0.0-alpha-3. When integrated with APIs or web frameworks that handle non-normalized requests, this vulnerability could allow attackers to bypass authentication mechanisms. Users are highly encouraged to update to the latest versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Apache Shiro 0 < 1.12.0

Apache Shiro 0 < 2.0.0-alpha-3

References

https://lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11w...
vendor-advisory
http://www.openwall.com/lists/oss-security/2023/07/24/4
https://security.netapp.com/advisory/ntap-20230915-0005/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tkswifty
Ha1c9on
.
CVE-2023-34478 : Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.