CVE-2021-41303CWE-287

CVE-2021-41303: vulnerability in Apache Shiro

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

Published · Updated

Follow this CVE+ Monitor Apache Shiro+ Monitor shiro

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

25Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 76%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
5 products (6 components)
Red Hat OpenStack Platform 13 (Queens) · Red Hat Fuse 7 · Red Hat JBoss A-MQ 6 · Red Hat JBoss Fuse 6 · Red Hat OpenStack Platform 10 (Newton)
none_available: Fix deferred
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
Affected products
Apache Software Foundation · Apache Shiro
Related CVEs — Apache Shiro

In the same product, most dangerous first.

CVE-2022-32532—Authentication Bypass VulnerabilityEPSS 25.5%CVE-2020-11989—CVE-2020-11989EPSS 24.4%CVE-2022-40664CRITICALAuthentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherEPSS 3.6%CVE-2023-34478CRITICALApache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.EPSS 2.1%CVE-2023-22602—Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestEPSS 1.6%CVE-2023-46750MEDIUMApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.EPSS 1.5%