You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@shiro.apache.org by bd...@apache.org on 2024/01/12 16:28:33 UTC
(shiro-site) branch 46749 created (now e2190fbec)
This is an automated email from the ASF dual-hosted git repository.
bdemers pushed a change to branch 46749
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
at e2190fbec Update security report with cve-2023-46749
This branch includes the following new commits:
new e2190fbec Update security report with cve-2023-46749
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(shiro-site) 01/01: Update security report with cve-2023-46749
Posted by bd...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
bdemers pushed a commit to branch 46749
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
commit e2190fbec789343d6cef72ecacd48c4de900f613
Author: Brian Demers <bd...@apache.org>
AuthorDate: Fri Jan 12 11:28:22 2024 -0500
Update security report with cve-2023-46749
---
src/site/content/security-reports.adoc | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/site/content/security-reports.adoc b/src/site/content/security-reports.adoc
index 71a8cceed..78d287088 100644
--- a/src/site/content/security-reports.adoc
+++ b/src/site/content/security-reports.adoc
@@ -29,6 +29,12 @@ A https://www.apache.org/security/committers.html[more detailed description of t
== Apache Shiro Vulnerability Reports
+=== link:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46749[CVE-2023-46749]
+
+Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
+
+**Mitigation:** Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).
+
=== link:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46750[CVE-2023-46750]
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.