CVE-2020-11989

CRITICAL9.8EPSS 84.7%

Improper Authentication in Apache Shiro

Published: 5/7/2021Modified: 11/8/2023
Also known as:GHSA-72w9-fcj5-3fcgDEBIAN-CVE-2020-11989

Description

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Affected packages (3)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (11)