WaratekVRT Sign in

Medium Apache Shiro CVEs

8 CVEs, 2 protected by Waratek

Reset
More filters (2)
Columns
Vendor apache✕Product shiro✕
Overview 8 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
8matches 2protected25.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC12.5% 1EPSS ≥ 0.512.5%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 75.0%
Critical 0 0.0% High 0 0.0% Medium 8 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 12.5% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 6 75.0%
split by peak 5 / year
No exploit published: 6Protected by Waratek: 2 Medium: 8 not blocked: 6blocked by ARMR today: 2 No public exploit: 6Proof of concept only: 1Working exploit published: 1
20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20210 20220 20231 No exploit published1 Medium1 not blocked1 Proof of concept only1 20241 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20250 20265 No exploit published5 Medium5 not blocked5 No public exploit5
201020122014201620182020202220242026
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-58301 Medium 2026-08-31 No exploit published No public exploit When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
CVE-2026-44598 Medium 2026-05-25 No exploit published No public exploit With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro. This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie. After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login. This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
CVE-2026-43828 Medium 2026-05-25 No exploit published No public exploit Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.
CVE-2026-43827 Medium 2026-05-25 No exploit published No public exploit Default configurations of Apache Shiro have a session fixation vulnerability. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, when a session already exists, it is not invalidated upon successful login, nor is a new session being generated with a new ID.
CVE-2026-23903 Medium 2026-02-09 No exploit published No public exploit Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7. Users are recommended to upgrade to version 2.0.7, which fixes the issue. The issue only effects static files. If static files are served from a case-insensitive filesystem, such as default macOS setup, static files may be accessed by varying the case of the filename in the request. If only lower-case (common default) filters are present in Shiro, they may be bypassed this way. Shiro 2.1.0 and later has a new parameters to remediate this issue shiro.ini: filterChainResolver.caseInsensitive = true application.properties: shiro.caseInsensitive=true Shiro 3.0.0 and later makes this the default in shiro.ini-based configurations. Shiro 3.0.1 and later makes this the default in all configurations, including programmatic and Spring / Spring Boot.
CVE-2023-46749 Medium 2024-01-15 Protected by Waratek No public exploit Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).
CVE-2023-46750 Medium 2023-12-14 No exploit published Proof of concept only URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
CVE-2010-3863 Medium 2010-11-05 Protected by Waratek Working exploit published Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.