CVE-2020-17523
CRITICAL 9.8EPSS 85.9%
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
- Affected
- Apache Shiro
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 9.0 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:C - EPSS
- 85.91% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2021-02-03
- Updated
- 2024-08-04
Proof-of-concept exploits (1)
- jweny/shiro-cve-2020-17523118★ · 2021-02-07
Exploit collections (1)
- Apache Shiro < 1.7.1 权限绕过漏洞（CVE-2020-17523）.mdtzwlhack/Vulnerability
Security advisories
- https://lists.apache.org/thread.html/rce5943430a6136d37a1f2fc201d245fe094e2727a0bc27e3b2d…
- advisories/GHSA-v98j-7crc-wvrj