This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-43828 | BDVDB-2026-334863 Detail

ApacheApache Shiro

Description#

Default configurations of Apache Shiro send sensitive cookies in HTTPS session without 'Secure' attribute. This issue affects Apache Shiro from 1.0 to 2.1.0, and 3.0.0-alpha-1. Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue. In the affected versions, Shiro-native session manager, as well as Remember-Me manager sends JSESSIONID and rememberMe cookies without 'secure' attribute by default.

Impact#

Per CVSS v4.0: confidentiality impact high, integrity impact none, availability impact none. Attack vector: network.

Weaknesses#

  • CWE-614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.