CVE-2021-41303 EPSS 76.1%

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

Apache Software Foundation · Apache Shiro

Summary

Apache Shiro versions before 1.8.0, when used with Spring Boot, contain an improper authentication flaw in the Apache Shiro component. An attacker who sends a specially crafted HTTP request can bypass authentication.

Heading is the official description · CVE.org

Breakdown

19.9 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 17 Sep 2021. No public exploit code or confirmed exploitation is recorded.

7 fixes in shiro-core over 4 years. The latest fix listed for shiro-core is 2.0.0-alpha4.

Fixes in shiro-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.5.2CVE-2020-195725 Mar 2020
1.5.3CVE-2020-1198922 Jun 2020
1.6.0CVE-2020-1393317 Aug 2020
1.8.0CVE-2021-4130317 Sep 2021
1.9.1CVE-2022-3253228 Jun 2022
1.10.0CVE-2022-4066412 Oct 2022
2.0.0-alpha4CVE-2023-4674915 Jan 2024Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.apache.shiro:shiro-core.

Mavenorg.apache.shiro:shiro-coreGHSA-f6jp-j6w3-w9hm

Upgrade to 1.8.0 or later

Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2016-4437, CVE-2020-1957).

Set the version to 1.8.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2021-41303.

Affected versions

If you run	Upgrade to
All versions before 1.8.0	1.8.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

4 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-2049

No public exploit code found.

, 30 Oct 2026

76.1%Top 0.47%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.53%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9953 19.9/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total19.9

Record

Published: 17 Sep 2021
Modified: 4 Aug 2024
: CWE-287 Improper Authentication
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Fixes in shiro-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

References

x_refsource_MISC 2

mailing-list 1

x_refsource_CONFIRM 1

techniques