CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2020-11989 – shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass
https://notcve.org/view.php?id=CVE-2020-11989
Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. Apache Shiro versiones anteriores a 1.5.3, cuando se usa Apache Shiro con controladores dinámicos Spring, una petición especialmente diseñada puede causar una omisión de autenticación A flaw was found in Apache Shiro in versions prior to 1.5.3. When using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. • https://github.com/HYWZ36/HYWZ36-CVE-2020-11989-code https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249d646d7abadb807ebf90f6fd2b014df21%40%3Cdev.geode.apache.org%3E https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cdev.shiro.apache.org%3E https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E https://lists.apache. • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-1957
https://notcve.org/view.php?id=CVE-2020-1957
Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. Apache Shiro versiones anteriores a 1.5.2, cuando se usa Apache Shiro con controladores dinámicos Spring, una petición especialmente diseñada puede causar una omisión de autenticación. • https://lists.apache.org/thread.html/r17f371fc89d34df2d0c8131473fbc68154290e1be238895648f5a1e6%40%3Cdev.shiro.apache.org%3E https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E https://lists.apache.org/thread.html/rb3982edf8bc8fcaa7a308e25a12d294fb4aac1f1e9d4e14fda639e77%40%3Cdev.geode.apache.org%3E https://lists.apache.org/thread.html/rc64fb2336683feff3580c3c3a8b28e80525077621089641f2f386b63%40 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12422 – shiro: Cookie padding oracle vulnerability with default configuration
https://notcve.org/view.php?id=CVE-2019-12422
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack. Apache Shiro versiones anteriores a 1.4.2, cuando se usa la configuración predeterminada "remember me", las cookies pueden ser susceptibles a un ataque de padding. • https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E https://access.redhat.com/security/cve/CVE-2019-12422 https://bugzilla.redhat.com/show_bug.cgi?id=1774726 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 97%CPEs: 4EXPL: 5CVE-2016-4437 – Apache Shiro Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-4437
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. Apache Shiro en versiones anteriores a 1.2.5, cuando una clave de cifrado no ha sido configurada por la característica "remember me", permite a atacantes remotos ejecutar código arbitrario o eludir las restricciones destinadas al acceso a través de un parámetro request no especificado. It was found that Apache Shiro uses a default cipher key for its "remember me" feature. An attacker could use this to devise a malicious request parameter and gain access to unauthorized content. Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature. • https://www.exploit-db.com/exploits/48410 https://github.com/pizza-power/CVE-2016-4437 https://github.com/xk-mt/CVE-2016-4437 https://github.com/m3terpreter/CVE-2016-4437 http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html http://rhn.redhat.com/errata/RHSA-2016-2035.html http://rhn.redhat.com/errata/RHSA-2016-2036.html http://www.securityfocus.com&# • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2014-0074 – Shiro: successful authentication without specifying user name or password
https://notcve.org/view.php?id=CVE-2014-0074
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password. Apache Shiro 1.x anterior a 1.2.3, cuando se utiliza un servidor LDAP con bind no autenticado habilitado, permite a atacantes remotos evadir la autenticación a través de (1) un nombre de usuario vació o (2) una contraseña vacía. It was discovered that Apache Shiro authenticated users without specifying a user name or a password when used in conjunction with an LDAP back end that allowed unauthenticated binds. • http://rhn.redhat.com/errata/RHSA-2014-1351.html http://seclists.org/fulldisclosure/2014/Mar/22 https://issues.apache.org/jira/browse/SHIRO-460 https://access.redhat.com/security/cve/CVE-2014-0074 https://bugzilla.redhat.com/show_bug.cgi?id=1072603 • CWE-287: Improper Authentication •