CVE-2023-46750
Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
CVE-2023-46750- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List
Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
CVE-2023-46750- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2023-3222
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
EUVD-2023-3222- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hhw5-c326-822h
Open redirect in Apache Shiro
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
GHSA-hhw5-c326-822h- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
CVE-2023-46750- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46750
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
DEBIAN-CVE-2023-46750- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-hhw5-c326-822h
Open redirect in Apache Shiro
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
GHSA-hhw5-c326-822h- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-46750
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
- Record
UBUNTU-CVE-2023-46750- CVSS 3.1
- 4.7 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-7147-1 No score
shiro vulnerabilities
It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An attacker could possibly use this issue to obtain sensitive information or administrative privileges. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-34478, CVE-2023-46749)
It was discovered that Apache Shiro incorrectly handled web redirects when used together with the form authentication method. An attacker could possibly use this issue to perform phishing attacks. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-46750)
It was discovered that Apache Shiro incorrectly handled requests through servlet filtering. An attacker could possibly use this issue to obtain administrative privileges. This update provides the corresponding fix for Ubuntu 16.04 LTS. (CVE-2016-6802)
- Record
USN-7147-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.shiro:shiro-webMaven |
before 1.13.0 | 1.13.0 |
org.apache.shiro:shiro-webMaven |
2.0.0-alpha-1 up to 2.0.0-alpha-4 | 2.0.0-alpha-4 |
shiroDebian:12 |
All versions, plus listed versions 1.3.2-51.3.2-6 |
None known |
shiroDebian:13 |
All versions, plus listed versions 1.3.2-6 |
None known |
shiroDebian:14 |
All versions, plus listed versions 1.3.2-6 |
None known |
org.apache.shiro:shiro-webMaven |
before 1.13.0, plus listed versions 1.0.0-incubating1.1.01.10.01.10.11.11.0 Show 25 moreShow less1.12.01.2.01.2.11.2.21.2.31.2.41.2.51.2.61.3.01.3.11.3.21.4.01.4.0-RC21.4.11.4.21.5.01.5.11.5.21.5.31.6.01.7.01.7.11.8.01.9.01.9.1 |
1.13.0 |
org.apache.shiro:shiro-webMaven |
2.0.0-alpha-1 up to 2.0.0-alpha-4, plus listed versions 2.0.0-alpha-22.0.0-alpha-3 |
2.0.0-alpha-4 |
shiroUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2 |
None known |
shiroUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.2-21.3.2-3~18.041.3.2-3~18.04.11.3.2-3ubuntu0.18.04.1~esm1 |
None known |
shiroUbuntu:20.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-4ubuntu0.11.3.2-4ubuntu0.2 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
shiroUbuntu:22.04:LTS |
All versions, plus listed versions 1.3.2-41.3.2-5 |
None known |
shiroUbuntu:Pro:24.04:LTS |
before 1.3.2-5ubuntu0.24.04.1~esm1, plus listed versions 1.3.2-5 |
1.3.2-5ubuntu0.24.04.1~esm1 |
shiroUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 1.2.4-1ubuntu0.1~esm2, plus listed versions 1.2.4-11.2.4-1ubuntu0.1~esm1 |
1.2.4-1ubuntu0.1~esm2 |
shiroUbuntu:Pro:24.04:LTS From an advisory covering 4 CVEs |
before 1.3.2-5ubuntu0.24.04.1~esm1, plus listed versions 1.3.2-5 |
1.3.2-5ubuntu0.24.04.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46750 is a medium vulnerability (CVSS 6.1) in Apache Shiro, published December 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in org.apache.shiro:shiro-web 1.13.0.
References
lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9
security.netapp.com/advisory/ntap-20240808-0002
nvd.nist.gov/vuln/detail/CVE-2023-46750
github.com/apache/shiro/commit/3b80f5c8e5a95ba31e92e4825ecc0ba3148b555a
Show 11 moreShow less
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2023-46750
ubuntu.com/security/CVE-2023-46750
cve.org/CVERecord?id=CVE-2023-46750