Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-46749

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

Published

2024-01-15T10:15:26.380

Last Modified

2025-06-03T14:15:29.913

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses
  • Type: Primary
    CWE-22
  • Type: Secondary
    CWE-22
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache shiro < 1.13.0 Yes
Application apache shiro 2.0.0 Yes
Application apache shiro 2.0.0 Yes
Application apache shiro 2.0.0 Yes
References