Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2020-13933

Published: 17/08/2020 Updated: 07/11/2023
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 446
Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Summary

Apache Shiro prior to 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

apache shiro

debian debian linux 9.0

Vendor Advisories

Debian CVElist Bug Report Logs: CVE-2020-13933
Debian Bug report logs - #968753 CVE-2020-13933 Package: src:shiro; Maintainer for src:shiro is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Thu, 20 Aug 2020 21:51:02 UTC Severity: important Tags: security, upstream Reply or subsc ...
Red Hat: Important: Red Hat JBoss Fuse/A-MQ 6.3 R18 security and bug fix update
Synopsis Important: Red Hat JBoss Fuse/A-MQ 63 R18 security and bug fix update Type/Severity Security Advisory: Important Topic An update is now available for Red Hat JBoss Fuse 63 and Red Hat JBoss A-MQ 63Red Hat Product Security has rated this update as having a security impact of Important A Common ...
Red Hat: Important: Red Hat Fuse 7.8.0 release and security update
Synopsis Important: Red Hat Fuse 780 release and security update Type/Severity Security Advisory: Important Topic A minor version update (from 77 to 78) is now available for Red Hat Fuse The purpose of this text-only errata is to inform you about the security issues fixed in this releaseRed Hat Produc ...

Mailing Lists

Full Disclosure: [CVE-2020-13933] Apache Shiro Authentication Bypass Vulnerability
<!--X-Body-Begin--> <!--X-User-Header--> oss-sec mailing list archives <!--X-User-Header-End--> <!--X-TopPNI--> By Date By Thread </form> <!--X-TopPNI-End--> <!--X-MsgBody--> <!--X-Subject-Header-Begin--> [CVE-2020-13933] Apache Shiro Authentication Bypass Vulnerability <!--X-Subject-Header-End--> <!--X-Head-of-Message--> From: ...

Github Repositories

https://github.com/360quake/papers

Articles accumulated by the 360Quake team.

Papers Articles accumulated by the 360Quake team quake360cn/quake/#/report Title Date 浅析 CobaltStrike钓鱼网站检测 2021-06-11 浅析 Cobalt Strike Team Server扫描 2021-04-15 浅析开源蜜罐识别 2020-12-18 SolarWinds失陷服务器测绘分析报告 2020-12-16 TLS server-side tagging 2020-12-14 利用JARM指纹进行TLS服务端标记

https://github.com/lyy289065406/CVE-2020-13933

CVE-2020-13933 靶场： shiro 认证绕过漏洞

CVE-2020-13933 靶场 shiro &lt; 160 身份认证绕过漏洞 PoC 127001:8080/res/%3bpoc 靶场环境 代码说明 ShiroConfigjava： 　　权限配置， 当请求 /res/* 资源时， 302 跳转到登陆页面进行身份认证 NameControllerjava： 　　· /res/{name}： 请求名为 name 的的资源（触发身份认证） 　　· /re

https://github.com/Kamimuka/cve-2020-13933

cve-2020-13933 apache shiro权限绕过漏洞

cve-2020-13933 cve-2020-13933 apache shiro权限绕过漏洞 这个复现非常简单，先用IDEA+shiro搭环境 参考：wwwcnblogscom/ph4nt0mer/p/13535999html 然后运行，访问，抓包即可

References

NVD-CWE-noinfohttps://lists.apache.org/thread.html/r539f87706094e79c5da0826030384373f0041068936912876856835f%40%3Cdev.shiro.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2021/08/msg00002.htmlhttps://lists.apache.org/thread.html/r18b45d560d76c4260813c802771cc9678aa651fb8340e09366bfa198%40%3Cdev.geode.apache.org%3Ehttps://lists.apache.org/thread.html/r9ea6d8560d6354d41433ad006069904f0ed083527aa348b5999261a7%40%3Cdev.geode.apache.org%3Ehttps://lists.apache.org/thread.html/r6ea0224c1971a91dc6ade1f22508119a9c3bd56cef656f0c44bbfabb%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r4c1e1249e9e1acb868db0c80728c13f448d07333da06a0f1603c0a33%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r8097b81905f2a113ebdf925bcbc6d8c9d6863c807c9ee42e1e7c9293%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/rb5edf49cd1451475dbcf53826ba6ef1bb7872dd6493d6112eb0c2bad%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r4506cedc401d6b8de83787f8436aac83956e411d66848c84785db46d%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r70098e336d02047ce4d4e69293fe8d558cd68cde06f6430398959bc4%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/rb47d88af224e396ee34ffb88ee99fb6d04510de5722cf14b7137e6bc%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r575301804bfac87a064359cf4b4ae9d514f2d10db7d44120765f4129%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r70b907ccb306e9391145e2b10f56cc6914a245f91720a17a486c020a%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r9d93dfb5df016b1a71a808486bc8f9fbafebbdbc8533625f91253f1d%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/re25b8317b00a50272a7252c4552cf1a81a97984cc2111ef7728e48e0%40%3Cdev.shiro.apache.org%3Ehttps://lists.apache.org/thread.html/r852971e28f54cafa7d325bd7033115c67d613b112a2a1076817390ac%40%3Cdev.shiro.apache.org%3Ehttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968753https://nvd.nist.govhttps://github.com/360quake/papers
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7073CVE-2024-5496CVE-2024-5495XPath injectionbypassCVE-2024-30043CVE-2024-24919denial of serviceCVE-2024-35468
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook