CVE-2023-46749: Apache Shiro vulnerable to path traversal
Summary
CVE-2023-46749: Apache Shiro vulnerable to path traversal. Affects org.apache.shiro:shiro-core across 2 version ranges.
< 1.13.0
>= 2.0.0alpha1, < 2.0.0-alpha4
Fixed in 1.13.0 or 2.0.0-alpha4, depending on the release line you run. How to fix ↓
Also tracked for
- shiro · Debian:11
The same CVE-2023-46749 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and easy-to-use Java security framework that provides authentication, authorization, cryptography, and session management capabilities. It is widely used in various Java applications to secure sensitive data and protect against unauthorized access. However, versions before 1.130 or 2.0.0-alpha-4 of Apache Shiro are susceptible to a path traversal attack when used in conjunction with path rewriting.
Vulnerability Detail
The path traversal vulnerability in Apache Shiro allows an attacker to bypass authentication by exploiting a flaw in the path rewriting mechanism. By manipulating the path parameter, an attacker can traverse directories and access unauthorized resources. This can lead to unauthorized access to sensitive data or functionality within the application. The vulnerability has a moderate severity rating and is assigned the Common Weakness Enumeration (CWE) ID 22.
How To Fix
Latest published version: 3.0.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.13.01.13.0 -
>= 2.0.0alpha1, < 2.0.0-alpha42.0.0-alpha4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the Apache Shiro version is not feasible, you can enable the 'blockSemicolon' option in the configuration. This can be done by modifying the Shiro configuration file and setting the 'blockSemicolon' property to 'true'. Here is an example of how to enable the 'blockSemicolon' option in the shiro.ini file:
[main] blockSemicolon = true
By enabling this option, the path traversal vulnerability can be mitigated.
Conclusion
Apache Shiro versions before 1.130 or 2.0.0-alpha-4 are vulnerable to a path traversal attack that can result in an authentication bypass. It is crucial to update to the latest secure version of Apache Shiro or enable the 'blockSemicolon' option in the configuration to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.shiro:shiro-core →
FAQ
Apache Shiro is a Java security framework that provides authentication, authorization, cryptography, and session management capabilities. It is widely used in Java applications to secure sensitive data and protect against unauthorized access.
A path traversal vulnerability allows an attacker to access files or directories outside of the intended scope. In the case of Apache Shiro, this vulnerability can be exploited to bypass authentication and gain unauthorized access to sensitive resources.
The path traversal vulnerability in Apache Shiro can lead to an authentication bypass, allowing an attacker to access unauthorized resources and potentially compromise sensitive data or functionality within the application.
To fix the vulnerability, it is recommended to update to Apache Shiro version 1.13.0 or later, or version 2.0.0-alpha-4 or later. Alternatively, you can enable the 'blockSemicolon' option in the Shiro configuration to mitigate the vulnerability.
Yes, if updating the Apache Shiro version is not feasible, you can enable the 'blockSemicolon' option in the configuration. This can be done by modifying the Shiro configuration file and setting the 'blockSemicolon' property to 'true'.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shiro:shiro-core.
