First published: Mon Jul 24 2023(Updated: )
Apache Shiro could allow a remote authenticated attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Credit: security@apache.org security@apache.org security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
Apache Shiro | <1.12.0 | |
Apache Shiro | =2.0.0-alpha1 | |
Apache Shiro | =2.0.0-alpha2 | |
IBM Planning Analytics | <=2.0 | |
maven/org.apache.shiro:shiro-web | >=2.0.0-alpha-1<2.0.0-alpha-3 | 2.0.0-alpha-3 |
maven/org.apache.shiro:shiro-web | <1.12.0 | 1.12.0 |
debian/shiro | <=1.3.2-4+deb11u1<=1.3.2-5 | |
<1.12.0 | ||
=2.0.0-alpha1 | ||
=2.0.0-alpha2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2023-34478 is a vulnerability in Apache Shiro that may allow a path traversal attack resulting in an authentication bypass.
CVE-2023-34478 has a severity score of 9.8, which is considered critical.
Apache Shiro versions 1.12.0 and 2.0.0-alpha-3, as well as versions 2.0.0-alpha2 and 2.0.0-alpha1, are affected by CVE-2023-34478.
To mitigate CVE-2023-34478, update Apache Shiro to version 1.12.0 or 2.0.0-alpha-3.
You can find more information about CVE-2023-34478 at the following references: - [NIST CVE-2023-34478](https://nvd.nist.gov/vuln/detail/CVE-2023-34478) - [Apache Mailing List](https://lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk) - [Openwall](http://www.openwall.com/lists/oss-security/2023/07/24/4)