CVE-2020-11989

CVE-2020-11989: fallo en Apache Shiro

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Apache Shiro+ Monitorear shiro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 24%
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Productos afectados
Apache Software Foundation · Apache Shiro
CVEs relacionadas — Apache Shiro

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-41303—Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypassEPSS 76.1%CVE-2022-32532—Authentication Bypass VulnerabilityEPSS 25.5%CVE-2022-40664CRITICALAuthentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherEPSS 3.6%CVE-2023-34478CRITICALApache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.EPSS 2.1%CVE-2023-22602—Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestEPSS 1.6%CVE-2023-46750MEDIUMApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.EPSS 1.5%