PT-2010-5126 · Apache+1 · Apache Shiro+1

Published 2010-11-05 · Updated 2022-05-14 · CVE-2010-3863

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.1.0 JSecurity version 0.9.x

Description The issue allows remote attackers to bypass intended access restrictions by sending a crafted request. This is demonstrated by the "/./account/index.jsp" URI, which can be used to circumvent restrictions. The problem arises because URI paths are not properly canonicalized before being compared to entries in the shiro.ini file.

Recommendations For Apache Shiro versions prior to 1.1.0, update to version 1.1.0 or later to resolve the issue. For JSecurity version 0.9.x, consider disabling access to sensitive areas of the application until a patch or update is available, or apply configuration changes to restrict access to intended areas.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2010-3863

GHSA-3JX9-MGWX-4Q83

Affected Products

Apache Shiro

Security

References · 15

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html · Exploit
• 🔥 https://exploit-db.com/exploits/34952 · Exploit
• 🔥 http://securityfocus.com/bid/44616 · Exploit
• http://secunia.com/advisories/41989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3863 · Security Note
• https://osv.dev/vulnerability/GHSA-3jx9-mgwx-4q83 · Vendor Advisory
• https://github.com/apache/shiro · Note
• https://web.archive.org/web/20101120091718/http://vupen.com/english/advisories/2010/2888 · Note
• https://web.archive.org/web/20161017000748/http://securityfocus.com/archive/1/514616/100/0/threaded · Note
• http://securityfocus.com/archive/1/514616/100/0/threaded · Note
• https://web.archive.org/web/20110929165859/http://securityfocus.com/bid/44616 · Note
• https://web.archive.org/web/20101129043410/http://secunia.com/advisories/41989 · Note
• http://vupen.com/english/advisories/2010/2888 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62959 · Note
• http://osvdb.org/69067 · Note