CVE-2010-3863
Published Nov 5, 2010
Last updated 6 years ago
Overview
- Description
- Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
- Source
- secalert@redhat.com
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
- nvd@nist.gov
- CWE-22
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36E31AB0-3484-46E1-8C7A-5FAA92B21167",
"versionEndIncluding": "1.0.0"
},
{
"criteria": "cpe:2.3:a:jsecurity:jsecurity:0.9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9B625E5-8D60-4E40-B887-DDC8B21FB2F7"
}
],
"operator": "OR"
}
]
}
]