CVE-2022-40664criticalCWE-287

Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 2.7%

probabilidade de exploração

2.7%top 15% das CVEs

exploração observada

nãonenhuma fonte reporta

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Apache Software Foundation · Apache Shiro

Referências

https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg https://security.netapp.com/advisory/ntap-20221118-0005/http://www.openwall.com/lists/oss-security/2022/10/12/1 http://www.openwall.com/lists/oss-security/2022/10/12/2 http://www.openwall.com/lists/oss-security/2022/10/13/1