Description

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

Remediation

References

http://www.openwall.com/lists/oss-security/2022/10/12/1

http://www.openwall.com/lists/oss-security/2022/10/12/2

http://www.openwall.com/lists/oss-security/2022/10/13/1

https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg

https://security.netapp.com/advisory/ntap-20221118-0005/

Related Vulnerabilities

CVE-2022-25908 Vulnerability in npm package create-choo-electron

CVE-2020-7733 Vulnerability in maven package org.webjars.npm:ua-parser-js

CVE-2021-21631 Vulnerability in maven package org.jenkins-ci.plugins:cloud-stats

CVE-2019-10389 Vulnerability in maven package org.jenkins-ci.plugins:relution-publisher

CVE-2019-10803 Vulnerability in npm package push-dir

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Release Notes Vendor Advisory Broken Link NVD-CWE-noinfo