CVE-2020-11989: Critical severity apache shiro vulnerability
A flaw was found in Apache Shiro in versions prior to 1.5.3. When using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Other sources
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-11989 vulnerability?
CVE-2020-11989 is a vulnerability in Apache Shiro where a specially crafted request can cause an authentication bypass when using Apache Shiro with Spring dynamic controllers.
What is the severity of CVE-2020-11989?
The severity of CVE-2020-11989 is critical with a severity value of 9.
How does CVE-2020-11989 affect the system?
CVE-2020-11989 can lead to data confidentiality and integrity vulnerabilities, as well as system availability issues.
How can I fix CVE-2020-11989?
To fix CVE-2020-11989, upgrade to Apache Shiro version 1.5.3 or later.
Where can I find more information about CVE-2020-11989?
You can find more information about CVE-2020-11989 at the following references: [CVE-2020-11989](https://www.cve.org/CVERecord?id=CVE-2020-11989), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-11989), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1850069), [Red Hat Errata](https://access.redhat.com/errata/RHSA-2020:5568).