MEDIUM 5.4
GHSA-7pq2-fhx9-x464
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login
Details
Apache Shiro’s Jakarta EE module used the HTTP Referer header in certain cases to issue redirect after a user login. In affected versions, insufficient validation of this client-controlled value could allow an attacker to influence the redirect target in applications using the Jakarta EE module. This issue affects Apache Shiro from 2.0-alpha to 2.2.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.apache.shiro:shiro-jakarta-ee
Introduced in:
2.0-alpha Fixed in: 2.2.1 Fix
# pom.xml: bump <version>2.2.1</version> for org.apache.shiro:shiro-jakarta-ee Maven / org.apache.shiro:shiro-jakarta-ee
Introduced in:
3.0.0-alpha-0 Fixed in: 3.0.0-alpha-2 Fix
# pom.xml: bump <version>3.0.0-alpha-2</version> for org.apache.shiro:shiro-jakarta-ee