medium5.0Public exploit code
CVE-2010-3863
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote att…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Apache Shiro - Directory Traversal2010-11-02 · remote · multiple · Verified
Impact
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Shiro | through 1.0.0 |
| Jsecurity | Jsecurity | Version 0.9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
- http://osvdb.org/69067
- http://secunia.com/advisories/41989
- http://www.securityfocus.com/archive/1/514616/100/0/threaded
- http://www.securityfocus.com/bid/44616
- http://www.vupen.com/english/advisories/2010/2888
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62959
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
- http://osvdb.org/69067
- http://secunia.com/advisories/41989
- http://www.securityfocus.com/archive/1/514616/100/0/threaded
- http://www.securityfocus.com/bid/44616
- http://www.vupen.com/english/advisories/2010/2888
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62959