Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17510
Reference (s):
- https://lists.apache.org/thread.html/rc2cff2538b683d480426393eecf1ce8dd80e052fbef49303b4f47171%40%3Cdev.shiro.apache.org%3E
- URL: https://lists.apache.org/thread.html/rc2cff2538b683d480426393eecf1ce8dd80e052fbef49303b4f47171%40%3Cdev.shiro.apache.org%3E
- MLIST:[announce] 20201105 [CVE-2020-17510] Apache Shiro 1.7.0 released
- URL: https://lists.apache.org/thread.html/r95bdf3703858b5f958b5e190d747421771b430d97095880db91980d6@%3Cannounce.apache.org%3E
- MLIST:[debian-lts-announce] 20210802 [SECURITY] [DLA 2726-1] shiro security update