CVE-2023-46749: Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).
Other sources
Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).
— GitHub
Apache Shiro could allow a remote authenticated attacker to bypass security restrictions, caused by a path traversal attack. By sending a specially crafted request with path rewriting, an attacker could exploit this vulnerability to perform authentication bypass.
— IBM
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46749?
CVE-2023-46749 has a high severity due to the potential for authentication bypass through a path traversal attack.
How do I fix CVE-2023-46749?
To fix CVE-2023-46749, update to Apache Shiro version 1.13.0 or higher, or 2.0.0-alpha-4 or higher.
Which versions of Apache Shiro are affected by CVE-2023-46749?
Apache Shiro versions before 1.13.0 and 2.0.0-alpha-4 are affected by CVE-2023-46749.
What is a path traversal attack in the context of CVE-2023-46749?
In the context of CVE-2023-46749, a path traversal attack allows an attacker to bypass authentication by manipulating URL paths.
Is enabling blockSemicolon an effective mitigation for CVE-2023-46749?
Yes, enabling blockSemicolon can be an effective mitigation for CVE-2023-46749 if upgrading is not immediately possible.