Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-7cxr-h8wm-fg4c

Опубликовано: 14 янв. 2023
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

Apache Shiro Interpretation Conflict vulnerability

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: spring.mvc.pathmatch.matching-strategy = ant_path_matcher

Пакеты

Наименование

org.apache.shiro:shiro-root

maven
Затронутые версииВерсия исправления

< 1.11.0

1.11.0

EPSS

Процентиль: 42%
0.00204
Низкий

7.5 High

CVSS3

Дефекты

CWE-436

Связанные уязвимости

CVSS3: 7.5
ubuntu
около 3 лет назад

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

CVSS3: 7.5
redhat
около 3 лет назад

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

CVSS3: 7.5
nvd
около 3 лет назад

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

CVSS3: 7.5
debian
около 3 лет назад

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, ...

CVSS3: 7.5
fstec
около 3 лет назад

Уязвимость фреймворка Apache Shiro и фреймворка создания веб-приложений Spring Boot, связанная с возникновением конфликта интерпретаций, позволяющая нарушителю обойти процедуру аутентификации

EPSS

Процентиль: 42%
0.00204
Низкий

7.5 High

CVSS3

Дефекты

CWE-436