Apache Shiro
Monthly
LDAP injection in Apache Shiro's DefaultLdapRealm allows remote unauthenticated attackers to manipulate Distinguished Name construction during LDAP bind authentication, potentially bypassing authentication or impersonating other users. The flaw affects all versions through 2.2.0 and 3.0.0-alpha-1 when DefaultLdapRealm is in use, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high integrity impact against an authentication-critical component.
Apache Shiro's default session and RememberMe cookie configuration omits the 'Secure' attribute, exposing JSESSIONID and rememberMe tokens to interception on any non-TLS channel in applications running versions 1.0 through 2.1.0 and 3.0.0-alpha-1. Successful exploitation allows an attacker with a network intercept position to capture and replay session or persistent-authentication tokens, fully hijacking an authenticated user's session. No public exploit has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation, making this primarily a risk in mixed HTTP/HTTPS or network-adjacent threat environments.
Session fixation in Apache Shiro 1.0 through 2.1.0 and 3.0.0-alpha-1 exposes authenticated user sessions to hijacking because the framework's default configuration neither invalidates the pre-existing session nor rotates the session ID upon successful login. An unauthenticated remote attacker who plants a known session token before the victim authenticates can reuse that token post-login to access the victim's authenticated context, resulting in high confidentiality impact to the vulnerable system. No public exploit has been identified at time of analysis; EPSS at 0.04% (13th percentile) and SSVC exploitation status of 'none' both reflect negligible observed exploitation activity.
LDAP injection in Apache Shiro's DefaultLdapRealm allows remote unauthenticated attackers to manipulate Distinguished Name construction during LDAP bind authentication, potentially bypassing authentication or impersonating other users. The flaw affects all versions through 2.2.0 and 3.0.0-alpha-1 when DefaultLdapRealm is in use, with no public exploit identified at time of analysis. The CVSS 4.0 score of 8.8 reflects high integrity impact against an authentication-critical component.
Apache Shiro's default session and RememberMe cookie configuration omits the 'Secure' attribute, exposing JSESSIONID and rememberMe tokens to interception on any non-TLS channel in applications running versions 1.0 through 2.1.0 and 3.0.0-alpha-1. Successful exploitation allows an attacker with a network intercept position to capture and replay session or persistent-authentication tokens, fully hijacking an authenticated user's session. No public exploit has been identified and CISA has not listed this in KEV; EPSS at 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation, making this primarily a risk in mixed HTTP/HTTPS or network-adjacent threat environments.
Session fixation in Apache Shiro 1.0 through 2.1.0 and 3.0.0-alpha-1 exposes authenticated user sessions to hijacking because the framework's default configuration neither invalidates the pre-existing session nor rotates the session ID upon successful login. An unauthenticated remote attacker who plants a known session token before the victim authenticates can reuse that token post-login to access the victim's authenticated context, resulting in high confidentiality impact to the vulnerable system. No public exploit has been identified at time of analysis; EPSS at 0.04% (13th percentile) and SSVC exploitation status of 'none' both reflect negligible observed exploitation activity.