Authentication bypass in Apache Shiro

CRÍTICO 9.8CVE-2020-17510 · GHSA-7cj4-gj8m-m2f7 · Published 05/11/2020 · updated 17/06/2026

En resumen

CVE-2020-17510 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a org.apache.shiro:shiro-spring, shiro (apache).
Probabilidad de explotación en los próximos 30 días (EPSS): 8.0%, mayor que el 94.8% de las vulnerabilidades.
Solución: actualizar a 1.7.0 o posterior.

Package	Affected versions	Patched versions
org.apache.shiro:shiro-spring Maven	`< 1.7.0`	`1.7.0`
shiro apache	`< 1.7.0`	`1.7.0`

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

NVD description

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.