{"id":"CVE-2016-6802","published":"2016-09-20T19:00:00Z","modified":"2024-08-06T01:43:37Z","title":"Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a…","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0968,"percentile":0.95464,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/archive/1/539397/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/92947","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":24.1,"factors":[{"name":"EPSS percentile","points":19.09},{"name":"Public exploit code","points":5.0}]},"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-all","vulnerableRanges":["<1.3.2"],"patched":["1.3.2"],"from":["GHSA-4q2v-j639-cp7p"],"provenance":"source"},{"ecosystem":"Maven","package":"org.apache.shiro:shiro-web","vulnerableRanges":["<1.3.2"],"patched":["1.3.2"],"from":["GHSA-4q2v-j639-cp7p"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2425","exploited":false,"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html","https://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html"]}