{"id":"CVE-2022-32532","published":"2022-06-28T23:20:11Z","modified":"2024-08-03T07:46:43Z","title":"Authentication Bypass Vulnerability","vendor":"Apache","product":"Apache Shiro","tier":"tail","description":{"text":"Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.25536,"percentile":0.97948,"provenance":"source"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh","tags":["x_refsource_MISC"]}],"priority":{"score":24.6,"factors":[{"name":"EPSS percentile","points":19.59},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":1,"earliest":"2022-06-29","earliestUrl":"https://github.com/Lay0us/CVE-2022-32532","repos":[{"name":"Lay0us/CVE-2022-32532","url":"https://github.com/Lay0us/CVE-2022-32532","stars":13,"created":"2022-06-29"}]},"first":{"date":"2022-06-29","source":"PoC-in-GitHub","url":"https://github.com/Lay0us/CVE-2022-32532"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Shiro","versions":["Before 1.9.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.9.1"],"patched":["1.9.1"],"from":["GHSA-4cf5-xmhp-3xj7"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-5920","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false},{"cve":"CVE-2021-41303","published":"2021-09-17","fixed":"1.8.0","kev":false,"link":{"from":"CVE-2021-41303","to":"CVE-2022-32532","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.8.0","toFixed":"1.9.1","daysApart":284}]}},{"cve":"CVE-2022-32532","published":"2022-06-28","fixed":"1.9.1","kev":false},{"cve":"CVE-2022-40664","published":"2022-10-12","fixed":"1.10.0","kev":false,"link":{"from":"CVE-2022-32532","to":"CVE-2022-40664","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.9.1","toFixed":"1.10.0","daysApart":106}]}},{"cve":"CVE-2023-46749","published":"2024-01-15","fixed":"2.0.0-alpha4","kev":false},{"cve":"CVE-2026-23901","published":"2026-02-10","fixed":"2.1.0","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}