CVE-2023-22602: Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request
A flaw was found in Apache Shiro. This issue may allow a malicious user to send a specially crafted HTTP request that could cause an authentication bypass.
Other sources
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.
The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: spring.mvc.pathmatch.matching-strategy = antpathmatcher
— MITRE
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-22602?
CVE-2023-22602 is a vulnerability found in Apache Shiro that may allow a malicious user to bypass authentication.
How does CVE-2023-22602 work?
CVE-2023-22602 occurs when using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, where a specially crafted HTTP request can cause an authentication bypass due to different pattern-matching techniques used by Shiro and Spring Boot.
What is the severity of CVE-2023-22602?
CVE-2023-22602 has a severity rating of high (7 out of 10).
Which software versions are affected by CVE-2023-22602?
CVE-2023-22602 affects Apache Shiro versions up to but excluding 1.11.0, as well as Spring Boot versions 2.6.0 and above.
How can I fix CVE-2023-22602?
To fix CVE-2023-22602, upgrade to Apache Shiro version 1.11.0 or higher, and Spring Boot version below 2.6.0.