CVE-2023-34478
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Risk Assessment
Organizations may be exposed to unauthorized access to resources, potentially leading to serious security breaches.
Recommendation
It is recommended to update to Apache Shiro version 1.12.0 or later, or 2.0.0-alpha-3 or later.
Original NVD description (English source)
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+