Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.shiro:shiro-web

7 known vulnerabilities (1 critical, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 critical, 3 medium, 1 low
Registry
Maven Central

Advisories 7

  • Apache Shiro: Remember-me cookie isn't checked for expiry on the server

    Affected: from 1.2.4, through 2.99.99; from 3.0.0-alpha-0, through 3.0.0-alpha-1; from 1.2.4, fixed in 3.0.0.

  • CVE-2026-43828Medium 5.9

    Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default

    Affected: from 1.0, through 2.1.0; from 3.0.0-alpha-0, through 3.0.0-alpha-1; from 1.0.0-incubating, fixed in 2.2.0; from 3.0.0-alpha-1, fixed in 3.0.0-alpha-2.

  • CVE-2026-23903Medium 5.3

    Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems

    Affected: fixed in 2.0.7.

  • CVE-2023-46750Medium 4.7

    Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

    Affected: fixed in 1.13.0; from 2.0.0-alpha-1, fixed in 2.0.0-alpha-4; fixed in 1.13.0; from 2.0.0-alpha-1, fixed in 2.0.0-alpha-4.

  • CVE-2023-34478Critical 9.8

    Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web…

    Affected: fixed in 1.12.0; from 2.0.0-alpha-1, fixed in 2.0.0-alpha-3.

  • Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

    Affected: fixed in 1.7.1.

  • Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet…

    Affected: fixed in 1.3.2.