CVE-2022-32532: Authentication Bypass Vulnerability
First published: Tue Jun 28 2022(Updated: )
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Shiro | <1.9.1 | |
| IBM IBM® Engineering Requirements Management DOORS | <=9.7.2.7 | |
| IBM IBM® Engineering Requirements Management DOORS Web Access | <=9.7.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-32532.
What is the title of this vulnerability?
The title of this vulnerability is 'Apache Shiro before 1.9.1 A RegexRequestMatcher can be misconfigured to be bypassed on some servlet …'
What is the description of this vulnerability?
The description of this vulnerability is that Apache Shiro before 1.9.1, a RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers, and applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
What is the severity of CVE-2022-32532?
The severity of CVE-2022-32532 is critical.
What is the affected software by CVE-2022-32532?
The affected software by CVE-2022-32532 is Apache Shiro before version 1.9.1.
How can I fix CVE-2022-32532?
To fix CVE-2022-32532, update Apache Shiro to version 1.9.1 or newer.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/apache
- canonical/apache shiro
- vendor/ibm
- canonical/ibm ibm® engineering requirements management doors
- version/ibm ibm® engineering requirements management doors/9.7.2.7
- canonical/ibm ibm® engineering requirements management doors web access
- version/ibm ibm® engineering requirements management doors web access/9.7.2.7