{"id":"CVE-2021-41303","published":"2021-09-17T08:20:12Z","modified":"2024-08-04T03:08:32Z","title":"Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an…","vendor":"Apache Software Foundation","product":"Apache Shiro","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Shiro","versions":[">= Apache Shiro, < 1.8.0"]}],"description":{"text":"Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Shiro versions before 1.8.0, when used with Spring Boot, contain an improper authentication flaw in the Apache Shiro component. An attacker who sends a specially crafted HTTP request can bypass authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:31Z"},"cvss":null,"epss":{"score":0.7613,"percentile":0.99531,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://lists.apache.org/thread.html/re470be1ffea44bca28ccb0e67a4cf5d744e2d2b981d00fdbbf5abc13%40%3Cannounce.shiro.apache.org%3E","tags":["x_refsource_MISC"]},{"url":"https://lists.apache.org/thread.html/raae98bb934e4bde304465896ea02d9798e257e486d04a42221e2c41b%40%3Cuser.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]},{"url":"https://security.netapp.com/advisory/ntap-20220609-0001/","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.8.0"],"patched":["1.8.0"],"from":["GHSA-f6jp-j6w3-w9hm"],"provenance":"source"}],"advisories":[{"id":"GHSA-f6jp-j6w3-w9hm","url":"https://github.com/advisories/GHSA-f6jp-j6w3-w9hm","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.8.0"],"patched":["1.8.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-2049","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2049","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-09-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-41303","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9953"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-1957","published":"2020-03-25","fixed":"1.5.2","kev":false},{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false,"link":{"from":"CVE-2020-13933","to":"CVE-2021-41303","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.6.0","toFixed":"1.8.0","daysApart":396}]}},{"cve":"CVE-2021-41303","published":"2021-09-17","fixed":"1.8.0","kev":false},{"cve":"CVE-2022-32532","published":"2022-06-28","fixed":"1.9.1","kev":false,"link":{"from":"CVE-2021-41303","to":"CVE-2022-32532","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.8.0","toFixed":"1.9.1","daysApart":284}]}},{"cve":"CVE-2022-40664","published":"2022-10-12","fixed":"1.10.0","kev":false},{"cve":"CVE-2023-46749","published":"2024-01-15","fixed":"2.0.0-alpha4","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}