Description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected products
- Apache Software Foundation / Apache Shiro0 – 1.13.0
- Apache Software Foundation / Apache Shiro2.0.0-alpha-1 – 2.0.0-alpha-4