CVE-2023-46750: shiro-web fixed in 2.0.0-alpha-4, 2.0.0-alpha and 1.13.0

CVE-2023-46750 PUBLISHED CVSS 6.099999904632568 MEDIUM

Open redirect in Apache Shiro

Reported by apache · Published December 14, 2023

shiro-web is fixed in 2.0.0-alpha-4, 2.0.0-alpha and 1.13.0 (Maven Central)

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
org.apache.shiro:shiro-web	Maven Central	2.0.0-alpha-4, 2.0.0-alpha, 1.13.0
shiro	apache	1.13.0

Risk scores

CVSS 3.1

6.099999904632568

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
Apache Software Foundation	Apache Shiro	0, 2.0.0-alpha-1
Maven	org.apache.shiro:shiro-web	0, 2.0.0-alpha-1
Apache Software Foundation	Apache Shiro	0, 2.0.0-alpha-1

Timeline

Dec 14, 2023 CVE Published
Dec 15, 2023 EPSS Score (30 in total, the first dated here)
Mar 17, 2026 Security Advisory
Jul 31, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2023-46750
vulnetix vdb fixes CVE-2023-46750

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-46750/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →