Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2022/10/12/1 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2022/10/12/2 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2022/10/13/1 | Mailing List Third Party Advisory |
https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg | Mailing List Release Notes Vendor Advisory |
https://security.netapp.com/advisory/ntap-20221118-0005/ | Broken Link Third Party Advisory |
Configurations
History
02 Feb 2023, 18:48
Type | Values Removed | Values Added |
---|---|---|
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20221118-0005/ - Broken Link, Third Party Advisory |
18 Nov 2022, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Oct 2022, 17:23
Type | Values Removed | Values Added |
---|---|---|
First Time |
Apache
Apache shiro |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
CPE | cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* | |
References | (CONFIRM) https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg - Mailing List, Release Notes, Vendor Advisory | |
References | (MLIST) http://www.openwall.com/lists/oss-security/2022/10/12/1 - Mailing List, Third Party Advisory | |
References | (MLIST) http://www.openwall.com/lists/oss-security/2022/10/12/2 - Mailing List, Third Party Advisory | |
References | (MLIST) http://www.openwall.com/lists/oss-security/2022/10/13/1 - Mailing List, Third Party Advisory |
13 Oct 2022, 09:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Oct 2022, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Oct 2022, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Oct 2022, 07:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-10-12 07:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-40664
Mitre link : CVE-2022-40664
CVE.ORG link : CVE-2022-40664
JSON object : View
Products Affected
apache
- shiro
CWE
CWE-287
Improper Authentication