CVE-2022-32532
Authentication Bypass Vulnerability
CRITICAL 9.8EPSS 25.5%
Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
- Affected
- Apache Software Foundation · Apache Shiro
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 25.54% chance of exploitation in the next 30 days, 98th percentile
- Published
- 2022-06-28
- Updated
- 2024-08-03
Proof-of-concept exploits (4)
- Feigoss/test0★ · 2024-10-24
- Lay0us/CVE-2022-3253213★ · 2022-06-28
- Lay0us1/CVE-2022-3253213★ · 2022-06-28
- my0113/shiro-cve-2022-325320★ · 2025-08-22