CVE-2023-34478: Path Traversal in Apache Shiro

July 24, 2023 (updated February 13, 2025)

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests.

Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+

References

github.com/advisories/GHSA-pmhc-2g4f-85cg
github.com/apache/shiro
github.com/apache/shiro/commit/c3ede3f94efb442acb0795714a022c2c121d1da0
lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk
nvd.nist.gov/vuln/detail/CVE-2023-34478
security.netapp.com/advisory/ntap-20230915-0005

Code Behaviors & Features

Detect and mitigate CVE-2023-34478 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →