Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2020-13933GHSA-2VGM-WXR3-6W2J

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.6.0
3 proofs of concept on GitHub

Summary

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • n/a Apache Shiro

    Apache Shiro before version 1.6.0

  • org.apache.shiro:shiro-coreMaven

    fixed in 1.6.0

References 19

lists.apache.org

lists.debian.org

GitHub · 0xkami/cve-2020-13933

GitHub · EXP-Docs/CVE-2020-13933

GitHub · KingBangQ/CVE-2020-13933Project