CVE-2010-3863: Path Traversal
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3863?
CVE-2010-3863 is considered critical due to its potential to allow unauthorized access to sensitive resources.
How do I fix CVE-2010-3863?
To fix CVE-2010-3863, upgrade Apache Shiro to version 1.1.0 or later, or JSecurity to version 0.9.1 or later.
What systems are affected by CVE-2010-3863?
CVE-2010-3863 affects Apache Shiro versions before 1.1.0 and JSecurity 0.9.x.
What kind of attack does CVE-2010-3863 allow?
CVE-2010-3863 allows remote attackers to bypass access restrictions through crafted URI paths.
Is there a workaround for CVE-2010-3863?
There is no known effective workaround for CVE-2010-3863, so upgrading is strongly recommended.