CVE-2010-3863 - Vulnerability Details - OpenCVE

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Shiro
Jsecurity	Jsecurity

Configuration 1 [-]

OR	cpe:2.3:a:apache:shiro::::::::
	cpe:2.3:a:jsecurity:jsecurity:0.9.0:::::::*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
http://osvdb.org/69067
http://secunia.com/advisories/41989
http://www.securityfocus.com/archive/1/514616/100/0/threaded
http://www.securityfocus.com/bid/44616
http://www.vupen.com/english/advisories/2010/2888
https://exchange.xforce.ibmcloud.com/vulnerabilities/62959

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2010-11-05T16:28:00

Updated: 2024-08-07T03:26:11.892Z

Reserved: 2010-10-08T00:00:00

Link: CVE-2010-3863

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2010-11-05T17:00:02.577

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-3863

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-11-02T00:00:00", "descriptions": [{"lang": "en", "value": "Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "44616", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/44616"}, {"name": "41989", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/41989"}, {"name": "69067", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/69067"}, {"name": "20101103 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/514616/100/0/threaded"}, {"name": "20101102 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html"}, {"name": "shiro-filters-security-bypass(62959)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62959"}, {"name": "ADV-2010-2888", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2010/2888"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2010-3863", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "44616", "refsource": "BID", "url": "http://www.securityfocus.com/bid/44616"}, {"name": "41989", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/41989"}, {"name": "69067", "refsource": "OSVDB", "url": "http://osvdb.org/69067"}, {"name": "20101103 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/514616/100/0/threaded"}, {"name": "20101102 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "refsource": "FULLDISC", "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html"}, {"name": "shiro-filters-security-bypass(62959)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62959"}, {"name": "ADV-2010-2888", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2010/2888"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T03:26:11.892Z"}, "title": "CVE Program Container", "references": [{"name": "44616", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/44616"}, {"name": "41989", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/41989"}, {"name": "69067", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/69067"}, {"name": "20101103 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/514616/100/0/threaded"}, {"name": "20101102 CVE-2010-3863: Apache Shiro information disclosure vulnerability", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html"}, {"name": "shiro-filters-security-bypass(62959)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62959"}, {"name": "ADV-2010-2888", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2010/2888"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2010-3863", "datePublished": "2010-11-05T16:28:00", "dateReserved": "2010-10-08T00:00:00", "dateUpdated": "2024-08-07T03:26:11.892Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*", "matchCriteriaId": "36E31AB0-3484-46E1-8C7A-5FAA92B21167", "versionEndIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:jsecurity:jsecurity:0.9.0:*:*:*:*:*:*:*", "matchCriteriaId": "A9B625E5-8D60-4E40-B887-DDC8B21FB2F7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI."}, {"lang": "es", "value": "Apache Shiro anterior a v1.1.0 y JSecurity v0.9.x, no canoniza rutas URI antes de compararlas como entradas en el archivo shiro.ini, lo cual permite a atacantes remotos evitar las restricciones de acceso mediante una solicitud manipulada, como lo demuestra la URI /./account/index.jsp"}], "id": "CVE-2010-3863", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2010-11-05T17:00:02.577", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html"}, {"source": "secalert@redhat.com", "url": "http://osvdb.org/69067"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41989"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/archive/1/514616/100/0/threaded"}, {"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/44616"}, {"source": "secalert@redhat.com", "url": "http://www.vupen.com/english/advisories/2010/2888"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62959"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/69067"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41989"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/514616/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/44616"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2010/2888"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62959"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}