CVE-2020-1957:
Improper Authentication in Apache Shiro
9.8
CVSS ScoreBasic Information
CVE ID
GHSA ID
EPSS Score
-
CWE
Published
5/7/2021
Updated
2/1/2023
KEV Status
No
Technology
Java
JavaTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.shiro:shiro-core | maven | < 1.5.2 | 1.5.2 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from mismatches between Shiro's path matching implementation and Spring's controller routing when handling dynamic controllers. Key functions in the authentication flow include:
- AntPathMatcher.match(): Responsible for pattern matching security rules against request paths. The pre-1.5.2 implementation failed to properly handle edge cases like semicolons in paths.
- PathMatchingFilterChainResolver.getChain(): Determines which security filters apply to a request. Improper path matching here allowed crafted URLs to skip authentication requirements. The confidence is high because:
- The CVE description explicitly mentions Spring dynamic controller context
- Authentication bypass patterns align with known AntPathMatcher limitations
- Shiro 1.5.2 release notes mention 'path pattern matching improvements'
- Similar historical vulnerabilities (CVE-2020-11989) involved path normalization in these components