Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

shiro-web-1.5.1.jar: 3 vulnerabilities (highest severity is: 9.8) #12

Open
dev-mend-for-github-com bot opened this issue Oct 16, 2023 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@dev-mend-for-github-com
Copy link

dev-mend-for-github-com bot commented Oct 16, 2023

Vulnerable Library - shiro-web-1.5.1.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

Path to dependency file: /server/impl/pom.xml

Path to vulnerable library: /server/impl/pom.xml,/server/dist/pom.xml

Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (shiro-web version) Remediation Possible** Reachability
CVE-2020-1957 Critical 9.8 shiro-web-1.5.1.jar Direct 1.5.2
CVE-2020-17510 Critical 9.8 shiro-web-1.5.1.jar Direct 1.7.0
CVE-2020-11989 Critical 9.8 shiro-web-1.5.1.jar Direct 1.5.3

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-1957

Vulnerable Library - shiro-web-1.5.1.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

Path to dependency file: /server/impl/pom.xml

Path to vulnerable library: /server/impl/pom.xml,/server/dist/pom.xml

Dependency Hierarchy:

  • shiro-web-1.5.1.jar (Vulnerable Library)

Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f

Found in base branch: master

Vulnerability Details

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Publish Date: 2020-03-25

URL: CVE-2020-1957

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://shiro.apache.org/news.html

Release Date: 2020-03-25

Fix Resolution: 1.5.2

In order to enable automatic remediation, please create workflow rules

CVE-2020-17510

Vulnerable Library - shiro-web-1.5.1.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

Path to dependency file: /server/impl/pom.xml

Path to vulnerable library: /server/impl/pom.xml,/server/dist/pom.xml

Dependency Hierarchy:

  • shiro-web-1.5.1.jar (Vulnerable Library)

Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f

Found in base branch: master

Vulnerability Details

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Publish Date: 2020-11-05

URL: CVE-2020-17510

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/rc2cff2538b683d480426393eecf1ce8dd80e052fbef49303b4f47171%40%3Cdev.shiro.apache.org%3E

Release Date: 2020-11-05

Fix Resolution: 1.7.0

In order to enable automatic remediation, please create workflow rules

CVE-2020-11989

Vulnerable Library - shiro-web-1.5.1.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

Path to dependency file: /server/impl/pom.xml

Path to vulnerable library: /server/impl/pom.xml,/server/dist/pom.xml

Dependency Hierarchy:

  • shiro-web-1.5.1.jar (Vulnerable Library)

Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f

Found in base branch: master

Vulnerability Details

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Publish Date: 2020-06-22

URL: CVE-2020-11989

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/SHIRO-753

Release Date: 2020-06-22

Fix Resolution: 1.5.3

In order to enable automatic remediation, please create workflow rules


In order to enable automatic remediation for this issue, please create workflow rules

@dev-mend-for-github-com dev-mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Oct 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Development

No branches or pull requests

0 participants