VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jan 15, 2024· Updated Jun 17, 2026

CVE-2023-46749

CVE-2023-46749

Description

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.shiro:shiro-coreMaven
< 1.13.01.13.0
org.apache.shiro:shiro-coreMaven
>= 2.0.0alpha1, < 2.0.0-alpha42.0.0-alpha4

Affected products

6
  • Apache Software Foundation/Apache Shirov5
    Range: 0
  • ghsa-coords
    pkg:maven/org.apache.shiro/shiro-core
    Range: < 1.13.0
  • Apache/Shiro4 versions
    cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*range: <1.13.0
    • cpe:2.3:a:apache:shiro:2.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:2.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:apache:shiro:2.0.0:alpha3:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.