Improper Authentication in Apache Shiro - CVE-2021-41303
Published: September 17, 2021
Vulnerability identifier: #VU56683
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-41303
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in when processing authentication requests, when using Apache Shiro with Spring Boot. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Affected software
Apache Shiro
Oracle Financial Services Crime and Compliance Management Studio
Dell EMC PowerStore Family Operating System
Oracle Financial Services Crime and Compliance Management Studio
Dell EMC PowerStore Family Operating System
How to mitigate CVE-2021-41303
Install updates from vendor's website.
Apache Shiro - update to 1.8.0
Dell EMC PowerStore Family Operating System - update to 2.1.1.2- 1885194
Dell EMC PowerStore Family Operating System - update to 2.1.1.2- 1885194