PT-2023-30183 · Apache+3 · Apache Shiro+3

Claudio Villella · Published 2023-12-13 · Updated 2024-12-10 · CVE-2023-46750

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.13.0 Apache Shiro versions 2.0.0-alpha-1 through 2.0.0-alpha-3

Description The issue is related to a URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.

Recommendations Update to Apache Shiro 1.13.0 or later. Update to Apache Shiro 2.0.0-alpha-4 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2023-46750

GHSA-HHW5-C326-822H

USN-7147-1

Affected Products

Apache Shiro

Debian

Linuxmint

Ubuntu

References · 24

• https://cve.org/CVERecord?id=CVE-2023-46750 · Security Note
• https://ubuntu.com/security/CVE-2023-46749 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hhw5-c326-822h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46750 · Security Note
• https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46750 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46750 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-34478 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46750 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7147-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46750 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7147-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46750 · Vendor Advisory
• https://github.com/apache/shiro · Note