CVE-2020-17523

CRITICAL

Apache Shiro <1.7.1 - Auth Bypass

Title source: llm

Description

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Exploits (2)

nomisec WORKING POC 119 stars
by jweny · poc
https://github.com/jweny/shiro-cve-2020-17523
github WORKING POC 5 stars
by JAckLosingHeart · javapoc
https://github.com/JAckLosingHeart/CVE-PoC-Collection/tree/main/shiro-CVE-2020-17523

References (8)

Scores

CVSS v3 9.8
EPSS 0.8877
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-287
Status published

Affected Products (4)

apache/shiro < 1.7.1
org.apache.shiro/shiro-web < 1.7.1Maven
org.apache.shiro/shiro-spring < 1.7.1Maven
org.apache.shiro/shiro-spring-boot-starter < 1.7.1Maven

Timeline

Published Feb 03, 2021
Tracked Since Feb 18, 2026