VDB
DEBIAN-CVE-2023-22602
DEBIAN-CVE-2023-22602
PUBLISHED
CVSS 7.5 HIGH
When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:12 | shiro | 1.3.2-5, 1.3.2-6, 0 |
| Debian:13 | shiro | 0, 1.3.2-6, 0 |
| Debian:11 | shiro | 1.3.2-4, 1.3.2-4, 1.3.2-5 |
Timeline
- Jan 14, 2023 CVE Published
- Apr 28, 2026 CVE Updated