CVE-2010-3863

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 54.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-11-05 · updated 2026-06-16
Weakness: CWE-22

Description

Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.

Affected products

Apache Software Foundation Apache Shiro: through 1.0.0
Jsecurity: 0.9.0

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
http://osvdb.org/69067
http://secunia.com/advisories/41989
http://www.securityfocus.com/archive/1/514616/100/0/threaded
http://www.securityfocus.com/bid/44616
http://www.vupen.com/english/advisories/2010/2888
https://exchange.xforce.ibmcloud.com/vulnerabilities/62959
http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html
http://osvdb.org/69067
http://secunia.com/advisories/41989
http://www.securityfocus.com/archive/1/514616/100/0/threaded
http://www.securityfocus.com/bid/44616

Get alerted when CVE-2010-3863 or the next vulnerability affects your stack