CVE-2023-46750 Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

2023-12-1408:15:58

CWE-601

apache

www.cve.org

cve-2023-46750

apache shiro

url redirection

untrusted site

open redirect

form authentication

mitigation

update.

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

39.3%

JSON

URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability when “form” authentication is used in Apache Shiro.
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.shiro:shiro-web",
    "product": "Apache Shiro",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "1.13.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      },
      {
        "lessThan": "2.0.0-alpha-4",
        "status": "affected",
        "version": "2.0.0-alpha-1",
        "versionType": "semver"
      }
    ]
  }
]