Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass

CRITICAL 9.8CVE-2021-41303 · GHSA-f6jp-j6w3-w9hm · Published 17/09/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
org.apache.shiro:shiro-core Maven	`< 1.8.0`	`1.8.0`
shiro apache	`< 1.8.0`	`1.8.0`
financial services crime and compliance management studio oracle	`= 8.0.8.2.0= 8.0.8.3.0`	No fix yet

Description

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

NVD description

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

References

nvd.nist.gov/vuln/detail/CVE-2021-41303 · ADVISORY
lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b@%3Cuser.shiro.apache.org%3E · WEB
lists.apache.org/thread.html/re470be1ffea44bca28ccb0e67a4cf5d744e2d2b981d00fdbbf5abc13%40%3Cannounce.shiro.apache.org%3E · WEB
security.netapp.com/advisory/ntap-20220609-0001 · WEB
oracle.com/security-alerts/cpujul2022.html · WEB
lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b%40%3Cuser.shiro.apache.org%3E
security.netapp.com/advisory/ntap-20220609-0001 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free