Apache Shiro Jakarta Ee Module
Monthly
Open redirect and server-side request forgery in Apache Shiro's Jakarta EE integration module allow authenticated users to forge the unvalidated shiroSavedRequest cookie, causing the server to issue outbound HTTP GET requests to arbitrary URLs or redirect users to untrusted sites. Affected deployments span Shiro 2.0-alpha through 2.1.0 and 3.0.0-alpha-1, exclusively when the shiro-jakarta-ee module is deployed - a scoped condition that materially limits the attack surface. No public exploit or active exploitation has been identified; EPSS sits at 0.04% (12th percentile), consistent with SSVC exploitation status of 'none'.
Open redirect and server-side request forgery in Apache Shiro's Jakarta EE integration module allow authenticated users to forge the unvalidated shiroSavedRequest cookie, causing the server to issue outbound HTTP GET requests to arbitrary URLs or redirect users to untrusted sites. Affected deployments span Shiro 2.0-alpha through 2.1.0 and 3.0.0-alpha-1, exclusively when the shiro-jakarta-ee module is deployed - a scoped condition that materially limits the attack surface. No public exploit or active exploitation has been identified; EPSS sits at 0.04% (12th percentile), consistent with SSVC exploitation status of 'none'.