CVE-2010-3863: Path Traversal
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-rootto a version that resolves this vulnerability.Fixed in 1.1.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 1.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3863?
CVE-2010-3863 is considered critical due to its potential to allow unauthorized access to sensitive resources.
How do I fix CVE-2010-3863?
To fix CVE-2010-3863, upgrade Apache Shiro to version 1.1.0 or later, or JSecurity to version 0.9.1 or later.
What systems are affected by CVE-2010-3863?
CVE-2010-3863 affects Apache Shiro versions before 1.1.0 and JSecurity 0.9.x.
What kind of attack does CVE-2010-3863 allow?
CVE-2010-3863 allows remote attackers to bypass access restrictions through crafted URI paths.
Is there a workaround for CVE-2010-3863?
There is no known effective workaround for CVE-2010-3863, so upgrading is strongly recommended.