VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Jul 24, 2023· Updated Jun 17, 2026

CVE-2023-34478

CVE-2023-34478

Description

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.

Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.shiro:shiro-webMaven
< 1.12.01.12.0
org.apache.shiro:shiro-webMaven
>= 2.0.0-alpha-1, < 2.0.0-alpha-32.0.0-alpha-3

Affected products

5
  • Apache/Shiro3 versions
    cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*range: <1.12.0
    • cpe:2.3:a:apache:shiro:2.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:2.0.0:alpha2:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.apache.shiro/shiro-web
    Range: < 1.12.0
  • Apache Software Foundation/Apache Shirov5
    Range: 0

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.