PT-2023-4009 · Apache+3 · Apache Shiro+3

Ha1C9On + 2 · Published 2023-06-07 · Updated 2024-12-10 · CVE-2023-34478

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.12.0 or 2.0.0-alpha-3

Description The issue is related to a path traversal attack that can result in an authentication bypass when Apache Shiro is used together with APIs or other web frameworks that route requests based on non-normalized requests. This can allow a remote attacker to bypass security restrictions by sending specially crafted requests.

Recommendations Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+ to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-04307

CVE-2023-34478

GHSA-PMHC-2G4F-85CG

USN-7147-1

Affected Products

Apache Shiro

Debian

Linuxmint

Ubuntu

References · 25

• https://nvd.nist.gov/vuln/detail/CVE-2023-34478 · Security Note
• https://ubuntu.com/security/CVE-2023-46749 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-34478 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pmhc-2g4f-85cg · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-6802 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46750 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-34478 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34478 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-34478 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04307 · Security Note
• https://ubuntu.com/security/notices/USN-7147-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-34478 · Security Note
• https://osv.dev/vulnerability/USN-7147-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-34478 · Vendor Advisory
• https://lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk · Vendor Advisory