{"id":"CVE-2020-13933","published":"2020-08-17T20:19:53Z","modified":"2024-08-04T12:32:14Z","title":"Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass","vendor":null,"product":null,"tier":"tail","description":{"text":"Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.44411,"percentile":0.98758,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/r18b45d560d76c4260813c802771cc9678aa651fb8340e09366bfa198%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9ea6d8560d6354d41433ad006069904f0ed083527aa348b5999261a7%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r6ea0224c1971a91dc6ade1f22508119a9c3bd56cef656f0c44bbfabb%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r4c1e1249e9e1acb868db0c80728c13f448d07333da06a0f1603c0a33%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r8097b81905f2a113ebdf925bcbc6d8c9d6863c807c9ee42e1e7c9293%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb5edf49cd1451475dbcf53826ba6ef1bb7872dd6493d6112eb0c2bad%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r4506cedc401d6b8de83787f8436aac83956e411d66848c84785db46d%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f6430398959bc4%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb47d88af224e396ee34ffb88ee99fb6d04510de5722cf14b7137e6bc%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c020a%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re25b8317b00a50272a7252c4552cf1a81a97984cc2111ef7728e48e0%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r852971e28f54cafa7d325bd7033115c67d613b112a2a1076817390ac%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/08/msg00002.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":24.8,"factors":[{"name":"EPSS percentile","points":19.75},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2020-09-09","earliestUrl":"https://github.com/EXP-Docs/CVE-2020-13933","repos":[{"name":"EXP-Docs/CVE-2020-13933","url":"https://github.com/EXP-Docs/CVE-2020-13933","stars":14,"created":"2020-09-09"},{"name":"0xkami/cve-2020-13933","url":"https://github.com/0xkami/cve-2020-13933","stars":2,"created":"2020-09-23"},{"name":"KingBangQ/CVE-2020-13933Project","url":"https://github.com/KingBangQ/CVE-2020-13933Project","stars":0,"created":"2021-10-19"}]},"first":{"date":"2020-09-09","source":"PoC-in-GitHub","url":"https://github.com/EXP-Docs/CVE-2020-13933"},"provenance":"source"},"affectedVersions":[{"vendor":"n/a","product":"Apache Shiro","versions":["Apache Shiro before version 1.6.0"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.6.0"],"patched":["1.6.0"],"from":["GHSA-2vgm-wxr3-6w2j"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-0908","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-12422","published":"2019-11-18","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-1957","published":"2020-03-25","fixed":"1.5.2","kev":false},{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false,"link":{"from":"CVE-2020-11989","to":"CVE-2020-13933","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.5.3","toFixed":"1.6.0","daysApart":56}]}},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false},{"cve":"CVE-2021-41303","published":"2021-09-17","fixed":"1.8.0","kev":false,"link":{"from":"CVE-2020-13933","to":"CVE-2021-41303","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.6.0","toFixed":"1.8.0","daysApart":396}]}},{"cve":"CVE-2022-32532","published":"2022-06-28","fixed":"1.9.1","kev":false},{"cve":"CVE-2022-40664","published":"2022-10-12","fixed":"1.10.0","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}