cve.bz

CVE-2020-17523

9.8 criticalEPSS 86%

Critical (9.8) in apache shiro. EPSS 86% chance of exploitation in the next 30 days. Fixed in org.apache.shiro:shiro-web 1.7.1.

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
86% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v98j-7crc-wvrjMavenorg.apache.shiro:shiro-web<1.7.11.7.1
GHSA-v98j-7crc-wvrjMavenorg.apache.shiro:shiro-spring<1.7.11.7.1
GHSA-v98j-7crc-wvrjMavenorg.apache.shiro:shiro-spring-boot-starter<1.7.11.7.1

References

Check your stackJSON