SH
Product
Shiro
On CISA KEVExploited in the wild
25
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 4Medium 8Low 1
Watch
Add Shiro to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-22602 | 7.5 | Jan 14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.11.0 |
| CVE-2020-13933 | 7.5 | Aug 17 | Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass Affected: before 1.6.0 |
| CVE-2019-12422 | 7.5 | Nov 18 | Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack Affected: before 1.4.2 |
| CVE-2016-6802 | 7.5 | Sep 20 | Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path Affected: 1.3.1 |
Showing 4