CVE-2010-3863
Apache Shiro - Directory Traversal
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Apache Shiro anterior a v1.1.0 y JSecurity v0.9.x, no canoniza rutas URI antes de compararlas como entradas en el archivo shiro.ini, lo cual permite a atacantes remotos evitar las restricciones de acceso mediante una solicitud manipulada, como lo demuestra la URI /./account/index.jsp
Apache Shiro version 1.0.0-incubating suffers from an information disclosure vulnerability. Shiro's path-based filter chain mechanism did not normalize request paths before performing path-matching logic. The result is that Shiro filter chain matching logic was susceptible to potential path traversal attacks.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-10-08 CVE Reserved
- 2010-11-02 First Exploit
- 2010-11-04 CVE Published
- 2024-05-16 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://osvdb.org/69067 | Vdb Entry | |
| http://www.securityfocus.com/archive/1/514616/100/0/threaded | Mailing List | |
| http://www.vupen.com/english/advisories/2010/2888 | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/62959 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/34952 | 2010-11-02 | |
| http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html | 2024-08-07 | |
| http://www.securityfocus.com/bid/44616 | 2024-08-07 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/41989 | 2018-10-10 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Search vendor "Apache" | Shiro Search vendor "Apache" for product "Shiro" | <= 1.0.0 Search vendor "Apache" for product "Shiro" and version " <= 1.0.0" | - |
Affected
| ||||||
| Jsecurity Search vendor "Jsecurity" | Jsecurity Search vendor "Jsecurity" for product "Jsecurity" | 0.9.0 Search vendor "Jsecurity" for product "Jsecurity" and version "0.9.0" | - |
Affected
| ||||||