CVE-2010-3863 | BDVDB-2026-43920 Detail
Description#
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Impact#
No impact statement in the source data.
Weaknesses#
No weakness recorded in the source data.
References#
- http://www.securityfocus.com/bid/44616
- http://secunia.com/advisories/41989
- http://osvdb.org/69067
- http://www.securityfocus.com/archive/1/514616/100/0/threaded
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/62959
- http://www.vupen.com/english/advisories/2010/2888
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.