Read the docs
TI-2023-08792 Aliases CVE-2023-22602GHSA-7cxr-h8wm-fg4c

Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication…

Priority LOW 36CWE-436Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01596 75th percentileScored 2026-11-07
Fix Fixed org.apache.shiro:shiro-root (Maven): 1.11.0Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.apache.shiro:shiro-root (Maven)before 1.11.01.11.0Patch availableGHSA-7cxr-h8wm-fg4c
  • org.apache.shiro:shiro-root (Maven) Vendor— Affected before 1.11.0 Fixed in 1.11.0 Patch available GHSA-7cxr-h8wm-fg4c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*before 1.11.0VulnerableApache
cpe:2.3:a:vmware:spring_boot:2.6.0:\+:*:*:*:*:*:*2.6.0 \+VulnerableVMware
  • cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:* Versions before 1.11.0 Vulnerable ·Apache
  • cpe:2.3:a:vmware:spring_boot:2.6.0:\+:*:*:*:*:*:* Versions 2.6.0 \+ Vulnerable ·VMware

Remediation

  • Fix · GHSA-7cxr-h8wm-fg4c org.apache.shiro:shiro-root (Maven) Fixed in 1.11.0 Advisory →

Red Hat 2 advisories

  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
  • RHSA-2023:2100 Released 2023-05-03 · Red Hat rating Important
    Red Hat Integration Camel for Spring Boot 3.20.1 security update
    • RHINT Camel-Springboot 3.20.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
RHINT Camel-Springboot 3.20.1Fixed RHSA-2023:2100
Red Hat Fuse 7.12Fixed RHSA-2023:3954

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-22602
  2. 2026-10-03 Alias added: GHSA-7cxr-h8wm-fg4c

References

Advisory 2

Other 1

  • TI-2016-03813 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-13272 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2021-18132 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2022-14167 Authentication bypass in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2020-09649 Improper authentication in Apache Shiro CVSS 3.1CRITICAL 9.8
  • TI-2020-10910 Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass. CVSS 3.1HIGH 7.5
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences