CVE-2023-46749
MEDIUMApache Shiro <1.13.0, <2.0.0-alpha-4 - Path Traversal
Title source: llmDescription
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).
Exploits (1)
Scores
CVSS v3
6.5
EPSS
0.0020
EPSS Percentile
41.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-22
Status
published
Products (3)
apache/shiro
2.0.0 alpha1 (3 CPE variants)
apache/shiro
< 1.13.0
org.apache.shiro/shiro-core
0 - 1.13.0Maven
Published
Jan 15, 2024
Tracked Since
Feb 18, 2026