PT-2023-4009 · Apache+3 · Apache Shiro+3

Ha1C9On + 2 · Publicado 2023-06-07 · Atualizado 2024-12-10 · CVE-2023-34478

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.12.0 or 2.0.0-alpha-3

Description The issue is related to a path traversal attack that can result in an authentication bypass when Apache Shiro is used together with APIs or other web frameworks that route requests based on non-normalized requests. This can allow a remote attacker to bypass security restrictions by sending specially crafted requests.

Recommendations Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+ to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-04307

CVE-2023-34478

GHSA-PMHC-2G4F-85CG

USN-7147-1

Produtos afetados

Apache Shiro

Debian

Linuxmint

Ubuntu

Referências · 25

• https://github.com/apache/shiro · Nota
• https://github.com/apache/shiro/commit/c3ede3f94efb442acb0795714a022c2c121d1da0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34478 · Nota de Segurança
• https://ubuntu.com/security/CVE-2023-46749 · Aviso do Fabricante
• https://t.me/pentestingnews/37966 · Publicação no Telegram
• https://vuldb.com/ru/?id.235146 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-34478 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2023/07/24/4 · Nota
• https://security.netapp.com/advisory/ntap-20230915-0005 · Nota
• https://osv.dev/vulnerability/GHSA-pmhc-2g4f-85cg · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-6802 · Aviso do Fabricante
• https://t.me/cvenotify/96857 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-46750 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2023-34478 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/24/4 · Nota