Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
References
Link | Resource |
---|---|
http://www.openwall.com/lists/oss-security/2022/10/12/1 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2022/10/12/2 | Mailing List Third Party Advisory |
http://www.openwall.com/lists/oss-security/2022/10/13/1 | Mailing List Third Party Advisory |
https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg | Mailing List Release Notes Vendor Advisory |
https://security.netapp.com/advisory/ntap-20221118-0005/ | Broken Link Third Party Advisory |
Configurations
History
18 Nov 2022, 19:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
13 Oct 2022, 17:23
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-10-12 07:15
Updated : 2024-02-04 22:51
NVD link : CVE-2022-40664
Mitre link : CVE-2022-40664
CVE.ORG link : CVE-2022-40664
JSON object : View
Products Affected
apache
- shiro
CWE
CWE-287
Improper Authentication