{"id":"CVE-2020-1957","published":"2020-03-25T15:24:27Z","modified":"2024-08-04T06:54:00Z","title":"Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Apache Shiro","versions":["Apache Shiro to 1.5.2"]}],"description":{"text":"Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.23326,"percentile":0.97781,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-04-12","exploitedFirstSeen":"2021-04-12","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/r17f371fc89d34df2d0c8131473fbc68154290e1be238895648f5a1e6%40%3Cdev.shiro.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/rc64fb2336683feff3580c3c3a8b28e80525077621089641f2f386b63%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rb3982edf8bc8fcaa7a308e25a12d294fb4aac1f1e9d4e14fda639e77%40%3Cdev.geode.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/04/msg00014.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rc8b39ea8b3ef71ddc1cd74ffc866546182683c8adecf19c263fe7ac0%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rab1972d6b177f7b5c3dde9cfb0a40f03bca75f0eaf1d8311e5762cb3%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.5.2"],"patched":["1.5.2"],"from":["GHSA-26gr-cvq3-qxgf"],"provenance":"source"}],"advisories":[{"id":"GHSA-26gr-cvq3-qxgf","url":"https://github.com/advisories/GHSA-26gr-cvq3-qxgf","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.5.2"],"patched":["1.5.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0897","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0897","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-03-25","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-1957","provenance":"source"},{"date":"2021-04-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":54.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2029 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.56,"detail":"percentile 0.9778"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2016-4437","published":"2016-06-07","fixed":"1.2.5","kev":true},{"cve":"CVE-2019-12422","published":"2019-11-18","fixed":"1.4.2","kev":false,"link":{"from":"CVE-2019-12422","to":"CVE-2020-1957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.4.2","toFixed":"1.5.2","daysApart":128}]}},{"cve":"CVE-2020-1957","published":"2020-03-25","fixed":"1.5.2","kev":false},{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false,"link":{"from":"CVE-2020-1957","to":"CVE-2020-11989","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.5.2","toFixed":"1.5.3","daysApart":89},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same package + description similarity"}]}},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false},{"cve":"CVE-2021-41303","published":"2021-09-17","fixed":"1.8.0","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}