CVE-2023-22602: Interpretation Conflict

January 14, 2023 (updated November 7, 2023)

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: spring.mvc.pathmatch.matching-strategy = ant_path_matcher

References

lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl
nvd.nist.gov/vuln/detail/CVE-2023-22602

Code Behaviors & Features

Detect and mitigate CVE-2023-22602 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →