PT-2020-6900 · Apache+3 · Apache Shiro+3

Brian Demers · Published 2020-08-17 · Updated 2023-09-07 · CVE-2020-13933

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.6.0

Description The issue is related to weaknesses in the authentication procedure of the Apache Shiro framework. It may allow a remote attacker to bypass existing security restrictions by sending a specially crafted HTTP request.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2023-05298

CVE-2020-13933

DLA-2726-1

GHSA-2VGM-WXR3-6W2J

USN-6352-1

Affected Products

Apache Shiro

Linuxmint

Nexus Repository Manager

Ubuntu

References · 56

• 🔥 https://github.com/lyy289065406/CVE-2020-13933 · Exploit
• 🔥 https://github.com/EXP-Docs/CVE-2020-13933 · Exploit
• https://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3E · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13933 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6352-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17510 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-13933 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6352-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2726-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05298 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-13933 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-13933 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13933 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13933 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13933 · Vendor Advisory