title: Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
description: Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+
problem types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
defaultStatus: unaffected
product: Apache Shiro
vendor: Apache Software Foundation
versions:
lessThan: 1.12.0, status: affected, version: 0, versionType: semver
lessThan: 2.0.0-alpha-3, status: affected, version: 0, versionType: semver
}
metrics:
other: [
content: {'text': 'important'}
type: Textual description of severity
]