Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

Affected: Maven: org.apache.shiro:shiro-core

Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).

ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE undertow: OutOfMemoryError due to @MultipartConfig handling JSON-java: parser confusion leads to OOM logback: serialization vulnerability in logback receiver logback: A serialization vulnerability in logback receiver spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service jetty: hpack header values cause denial of service in http/2 jetty: Improper addition of quotation marks to user inputs in CgiServlet apache-avro: Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDK jetty: Improper validation of HTTP/1 content-length tomcat: HTTP request smuggling via malformed trailer headers shiro: path traversal attack may lead to authentication bypass Solr: Host environment variables are published via the Metrics API undertow: Out-of-memory Error after several closed connections with wildfly-http-client protocol tomcat: Leaking of unrelated request bodies in default error page springframework: URL Parsing with Host Validation spring-security: Broken Access Control With Direct Use of AuthenticatedVoter cxf-core: Apache CXF SSRF Vulnerability using the Aegis databinding

Affected: Ubuntu:Pro:16.04:LTS: shiro, Ubuntu:Pro:18.04:LTS: shiro, Ubuntu:20.04:LTS: shiro, Ubuntu:22.04:LTS: shiro, Ubuntu:Pro:24.04:LTS: shiro

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure `blockSemicolon` is enabled (this is the default).