Description

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

Remediation

References

http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html

http://www.securityfocus.com/archive/1/539397/100/0/threaded

http://www.securityfocus.com/bid/92947

Related Vulnerabilities

CVE-2021-21341 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2021-29060 Vulnerability in npm package color-string

CVE-2022-1291 Vulnerability in maven package org.webjars.npm:github-com-hhurz-tableexport-jquery-plugin

CVE-2018-1000844 Vulnerability in maven package com.squareup.retrofit2:converter-jaxb

CVE-2019-10468 Vulnerability in maven package com.elasticbox.jenkins-ci.plugins:kubernetes-ci

Severity

High

Classification

CWE-284 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Third Party Advisory VDB Entry