CVE-2010-3863 Apache Shiro Path Traversal vulnerability

What is CVE-2010-3863?

CVE-2010-3863 is a medium-severity authentication bypass vulnerability in n/a, published on 5 Nov 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

Weakness: CWE-22

Which versions are affected by CVE-2010-3863?

2 open source packages ship an affected version, including org.apache.shiro:shiro-root. It affects 2 products.

Products include Apache Shiro, Jsecurity Jsecurity.

How do I fix CVE-2010-3863?

Upgrade org.apache.shiro:shiro-root to 1.1.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2010-3863 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2010-3863 exists.

Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-34478 Path Traversal in Apache Shiro Critical 9.8
• CVE-2022-40664 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher Critical 9.8
• CVE-2022-32532 Authentication Bypass Vulnerability Critical 9.8
• CVE-2021-41303 Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass Critical 9.8
• CVE-2020-17523 Authentication bypass in Apache Shiro Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3jx9-mgwx-4q83.