GHSA-v98j-7crc-wvrjCriticalCVSS 9.8

Authentication bypass in Apache Shiro

Published
February 9, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-17523 →

📋 Description

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

🎯 Affected products3

  • maven/org.apache.shiro:shiro-web:< 1.7.1
  • maven/org.apache.shiro:shiro-spring:< 1.7.1
  • maven/org.apache.shiro:shiro-spring-boot-starter:< 1.7.1

🔗 References (13)