-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.shiro:shiro-web | maven | < 1.13.0 | 1.13.0 |
| org.apache.shiro:shiro-web | maven | >= 2.0.0-alpha-1, < 2.0.0-alpha-4 | 2.0.0-alpha-4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient URI validation in the InvalidRequestFilter. The patch adds 3 new security checks (blockEncodedPeriod, blockEncodedForwardSlash, blockRewriteTraversal) and modifies the containsTraversal logic to detect '/..;' and '/.;' patterns. The vulnerable versions lacked these checks, allowing crafted URLs with encoded characters (like %2e) and semicolon-appended traversal sequences to bypass security controls. The core vulnerable functions are the validation methods in InvalidRequestFilter that were enhanced in the patch.
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report