CVE-2010-3863

NameCVE-2010-3863
DescriptionApache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shiro (PTS)jessie1.2.3-1fixed
stretch1.3.2-1fixed
bullseye, sid, buster1.3.2-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shirosource(unstable)(not affected)

Notes

- shiro <not-affected> (Fixed before the initial release in Debian)

Search for package or bug name: Reporting problems