Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
Remediation
References
https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9
https://security.netapp.com/advisory/ntap-20240808-0002/
Related Vulnerabilities
CVE-2020-7238 Vulnerability in maven package io.netty:netty-codec-http
CVE-2017-7684 Vulnerability in maven package org.apache.openmeetings:openmeetings-server
CVE-2021-41182 Vulnerability in maven package org.webjars:jquery-ui
CVE-2022-29265 Vulnerability in maven package org.apache.nifi:nifi
CVE-2022-43396 Vulnerability in maven package org.apache.kylin:kylin-spark-engine