Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may     cause an authentication bypass. Users should update to Apache Shiro 1.8.0. (CVE-2021-41303)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may
    cause an authentication bypass. Users should update to Apache Shiro 1.8.0. (CVE-2021-41303)

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250492	Linux Distros Unpatched Vulnerability : CVE-2021-41303	Nessus	Misc.	critical
414332	SCA: security update for org.apache.shiro:shiro-core (GHSA-f6jp-j6w3-w9hm)	Tenable Cloud Security	SCA Checks	critical
414332	SCA: security update for org.apache.shiro:shiro-core (GHSA-f6jp-j6w3-w9hm)	Tenable Self-Hosted Container Security	SCA Checks	critical
161731	Apache Shiro < 1.8.0 Authentication Bypass	Nessus	Misc.	critical

Detections

Analytics

CVE-2021-41303

critical

Tenable Plugins

critical

critical

critical

critical