{"id":"CVE-2019-12422","aliases":["DEBIAN-CVE-2019-12422","EUVD-2020-0313","GHSA-r679-m633-g7wc","UBUNTU-CVE-2019-12422"],"status":"published","title":"Improper input validation in Apache Shiro","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.09101,"percentile":0.95339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2019-11-18T22:04:21Z","modified":"2026-10-24T10:30:38Z","exploits":[{"source":"pocgithub","id":"BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC","title":"BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC","date":"2024-11-08","url":"https://github.com/BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","fixed_in":["1.4.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-5","1.3.2-6"]},{"source":"osv","ecosystem":"Debian:13","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-6"]},{"source":"osv","ecosystem":"Debian:14","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2"}]}],"versions":["1.0.0-incubating","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.3.0","1.3.1","1.3.2","1.4.0","1.4.0-RC2","1.4.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4-1","1.2.4-1ubuntu0.1~esm1","1.2.4-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-2","1.3.2-3~18.04","1.3.2-3~18.04.1","1.3.2-3ubuntu0.18.04.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-4","1.3.2-4ubuntu0.1","1.3.2-4ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-4","1.3.2-5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-5"]}],"products":[{"vendor":"apache","product":"shiro"}],"references":[{"url":"https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-12422","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c@%3Cdev.shiro.apache.org%3E","tags":["web","report"]},{"url":"https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040@%3Ccommits.shiro.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r679-m633-g7wc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-12422","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-12422","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2019/11/18/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-12422","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-12422","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T22:04:21Z","modified":"2024-08-04T23:17:39.997Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2020-0313","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T22:04:21Z","modified":"2024-08-04T23:17:39Z","updated_at":"2026-11-03T02:40:46.416719Z"}],"ghsa":[{"id":"GHSA-r679-m633-g7wc","title":"Improper input validation in Apache Shiro","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2020-02-04T22:36:36Z","modified":"2023-03-06T20:47:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2019-12422","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T23:15:11.36Z","modified":"2026-06-17T02:14:37.537Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:37.024431Z"}],"osv":[{"id":"CVE-2019-12422","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T23:15:11.36Z","modified":"2026-10-24T10:30:38.209240944Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-12422","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T23:15:11.36Z","modified":"2026-10-05T04:00:03.573150627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"GHSA-r679-m633-g7wc","title":"Improper input validation in Apache Shiro","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2020-02-04T22:36:36Z","modified":"2024-12-05T05:38:38.036634Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2019-12422","description":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","status":"published","published":"2019-11-18T23:15:00Z","modified":"2025-10-24T04:47:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:19.202697Z"}]}}