CVE-2023-34478: Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-webto a version that resolves this vulnerability.Fixed in 2.0.0-alpha-3 - Upgrade
Upgrade
maven/org.apache.shiro:shiro-webto a version that resolves this vulnerability.Fixed in 1.12.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 1.12.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.0.0-alpha-3
Event History
Frequently Asked Questions
What is CVE-2023-34478?
CVE-2023-34478 is a vulnerability in Apache Shiro that may allow a path traversal attack resulting in an authentication bypass.
How severe is CVE-2023-34478?
CVE-2023-34478 has a severity score of 9.8, which is considered critical.
Which versions of Apache Shiro are affected by CVE-2023-34478?
Apache Shiro versions 1.12.0 and 2.0.0-alpha-3, as well as versions 2.0.0-alpha2 and 2.0.0-alpha1, are affected by CVE-2023-34478.
How can I mitigate CVE-2023-34478?
To mitigate CVE-2023-34478, update Apache Shiro to version 1.12.0 or 2.0.0-alpha-3.
Where can I find more information about CVE-2023-34478?
You can find more information about CVE-2023-34478 at the following references: - [NIST CVE-2023-34478](https://nvd.nist.gov/vuln/detail/CVE-2023-34478) - [Apache Mailing List](https://lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk) - [Openwall](http://www.openwall.com/lists/oss-security/2023/07/24/4)