oss-security - CVE-2023-46750: Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <03657eca-b6ef-5e25-15f9-832df4274f3d@apache.org>
Date: Wed, 13 Dec 2023 21:24:22 +0000
From: Brian Demers <bdemers@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-46750: Apache Shiro: URL Redirection to Untrusted Site
 ('Open Redirect') vulnerability in FORM authentication feature Apache
 Shiro. 

Severity: moderate

Affected versions:

- Apache Shiro before 1.13.0
- Apache Shiro 2.0.0-alpha-1 before 2.0.0-alpha-4

Description:

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro.
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

Credit:

Claudio Villella (finder)

References:

https://shiro.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-46750

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.