CVE-2010-3863

Description

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/62959

http://www.vupen.com/english/advisories/2010/2888

http://www.securityfocus.com/archive/1/514616/100/0/threaded

http://secunia.com/advisories/41989

http://osvdb.org/69067

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3