CVE-2010-3863

NameCVE-2010-3863
DescriptionApache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
shiro (PTS)jessie, jessie (lts)1.2.3-1+deb8u1fixed
stretch (security), stretch (lts), stretch1.3.2-1+deb9u2fixed
buster1.3.2-4+deb10u1fixed
bullseye1.3.2-4+deb11u1fixed
sid, trixie, bookworm1.3.2-5fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
shirosource(unstable)(not affected)

Notes

- shiro <not-affected> (Fixed before the initial release in Debian)

Search for package or bug name: Reporting problems