{"id":"CVE-2020-11989","published":"2020-06-22T18:06:37Z","modified":"2024-08-04T11:48:57Z","title":"Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may…","vendor":"Apache","product":"Apache Shiro","tier":"tail","description":{"text":"Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.24436,"percentile":0.97864,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cuser.shiro.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r72815a124a119c450b86189767d06848e0d380b1795c6c511d54a675%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rcf3d8041e1232201fe5d74fc612a193e435784d64002409b448b58fe%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r408fe60bc8fdfd7c74135249d646d7abadb807ebf90f6fd2b014df21%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":19.6,"factors":[{"name":"EPSS percentile","points":19.57}]},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Shiro","versions":["Apache Shiro 1.5.2 - 1.5.3"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.5.3"],"patched":["1.5.3"],"from":["GHSA-72w9-fcj5-3fcg"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0981","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-4437","published":"2016-06-07","fixed":"1.2.5","kev":true},{"cve":"CVE-2019-12422","published":"2019-11-18","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-1957","published":"2020-03-25","fixed":"1.5.2","kev":false,"link":{"from":"CVE-2020-1957","to":"CVE-2020-11989","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.5.2","toFixed":"1.5.3","daysApart":89},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same package + description similarity"}]}},{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false,"link":{"from":"CVE-2020-11989","to":"CVE-2020-13933","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.5.3","toFixed":"1.6.0","daysApart":56}]}},{"cve":"CVE-2021-41303","published":"2021-09-17","fixed":"1.8.0","kev":false},{"cve":"CVE-2022-32532","published":"2022-06-28","fixed":"1.9.1","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}