CVE-2010-3863
CVE-2010-3863
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Productos afectados
n/a · n/aPoCs públicas encontradas — 2
githubgithub.com/sh1inroot-alt/shiro-cve-2010-3863★ 1exploitdbwww.exploit-db.com/exploits/34952no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.htmlhttp://osvdb.org/69067http://secunia.com/advisories/41989https://exchange.xforce.ibmcloud.com/vulnerabilities/62959http://www.securityfocus.com/archive/1/514616/100/0/threadedhttp://www.securityfocus.com/bid/44616http://www.vupen.com/english/advisories/2010/2888