Login Request a demo
Unscored severity · published Nov 5, 2010
CVE-2010-3863
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass…
–
CVSS
54.5%
EPSS
No
On KEV
Description
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)54.5% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
Jsecurity · Jsecurity
0.9.0 · source: NVD
SH
Shiro · Apache
through 1.0.0 · source: NVD
Affected product
SH
Shiro
Apache
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3863
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3863
Exploit
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
osvdb.org
http://osvdb.org/69067
Vendor Advisory
http://secunia.com/advisories/41989
www.securityfocus.com
http://www.securityfocus.com/archive/1/514616/100/0/threaded
Exploit
http://www.securityfocus.com/bid/44616
www.vupen.com
http://www.vupen.com/english/advisories/2010/2888
More from Shiro
9.8
CVE-2016-4437
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access…
9.8
CVE-2023-34478
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web…
9.8
CVE-2022-40664
Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
9.8
CVE-2022-32532
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers
9.8
CVE-2021-41303
Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass