CVE-2010-3863

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote…

published November 5, 2010

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
55%
Percentile
99.0
In the wild
Unconfirmed
What it is

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.54521 · 99.0th percentile
Published
2010-11-05T16:28Z
EPSS history
Timeline
  • 05 NOV 16:28Z
    Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote…
    cvelistv5