Apache Shiro protection bypass
Published:		04.11.2010
Source:		BUGTRAQ
SecurityVulns ID:		11230
Type:		remote
Level:		5/10
Description:		Protection bypass via directory traversal.

Affected:		APACHE : Shiro 1.0
CVE:		CVE-2010-3863 (Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.)

Original document

APACHE, CVE-2010-3863: Apache Shiro information disclosure vulnerability (04.11.2010)

Discuss:

Read or add your comments to this news (0 comments)