CVE-2022-40664

CRITICAL

Apache Shiro < 1.10.0 - Authentication Bypass

Title source: rule

Description

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.

Exploits (2)

github WORKING POC 5 stars

by JAckLosingHeart · javapoc

https://github.com/JAckLosingHeart/CVE-PoC-Collection/tree/main/shiro-CVE-2022-40664

View Code ZIP pw:eip

inthewild

poc

https://github.com/jackey0/cve-2022-40664

View on inthewild

References (5)

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/10/12/1

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/10/12/2

[Mailing List, Third Party Advisory] http://www.openwall.com/lists/oss-security/2022/10/13/1

[Mailing List, Release Notes, Vendor Advisory] https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg

[Broken Link, Third Party Advisory] https://security.netapp.com/advisory/ntap-20221118-0005/

Scores

CVSS v3 9.8

EPSS 0.0062

EPSS Percentile 69.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-287

Status published

Affected Products (2)

apache/shiro < 1.10.0

org.apache.shiro/shiro-core < 1.10.0Maven

Timeline

Published Oct 12, 2022

Tracked Since Feb 18, 2026