Apache Shiro sends sensitive cookies in HTTPS session without 'Secure' attribute

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2026-43828 · ADVISORY
• apache/shiro · PACKAGE
• shiro.apache.org/security-reports.html · WEB
• openwall.com/lists/oss-security/2026/05/25/7 · WEB

Lỗ hổng khác của org.apache.shiro:shiro-web

• CVE-2023-46750TRUNG BÌNH 6.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to …
• CVE-2023-34478NGHIÊM TRỌNG 9.8Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when us…
• CVE-2020-17523NGHIÊM TRỌNG 9.8Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
• CVE-2016-6802CAO 7.5Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet contex…