Improper Access Control in Apache Shiro

HOCH 7.5CVE-2016-6802 · GHSA-4q2v-j639-cp7p · Published 20/09/2016 · updated 17/06/2026

Kurz gesagt

CVE-2016-6802 ist eine Schwachstelle (HOCH (CVSS 7.5)) in org.apache.shiro:shiro-all, org.apache.shiro:shiro-web, shiro (apache).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 9.7%, höher als bei 95.5% aller Schwachstellen.
Abhilfe: auf 1.3.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.apache.shiro:shiro-all Maven	`< 1.3.2`	`1.3.2`
org.apache.shiro:shiro-web Maven	`< 1.3.2`	`1.3.2`
shiro apache	`= 1.3.1`	No fix yet

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

NVD description

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.