CVE-2010-3863

NameCVE-2010-3863
DescriptionApache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shiro (PTS)buster1.3.2-4+deb10u1fixed
bullseye1.3.2-4+deb11u1fixed
bookworm, sid, trixie1.3.2-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shirosource(unstable)(not affected)

Notes

- shiro <not-affected> (Fixed before the initial release in Debian)

Search for package or bug name: Reporting problems