{"id":"CVE-2023-22602","aliases":["DEBIAN-CVE-2023-22602","EUVD-2023-0383","GHSA-7cxr-h8wm-fg4c"],"status":"published","title":"Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01596,"percentile":0.75948,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-436"],"published":"2023-01-14T09:33:39Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-root","fixed_in":["1.11.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.shiro:shiro-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-5","1.3.2-6"]},{"source":"osv","ecosystem":"Debian:13","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-6"]},{"source":"osv","ecosystem":"Debian:14","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-6"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.shiro:shiro-root","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0"}]}],"versions":["1.0.0-incubating","1.1.0","1.10.0","1.10.1","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.3.0","1.3.1","1.3.2","1.4.0","1.4.0-RC2","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"]}],"products":[{"vendor":"apache","product":"shiro"},{"vendor":"apache software foundation","product":"apache shiro"},{"vendor":"vmware","product":"spring_boot"}],"references":[{"url":"https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230302-0001/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22602","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7cxr-h8wm-fg4c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22602.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-22602","tags":["advisory"]},{"url":"https://github.com/apache/shiro","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-22602","title":"Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`\n\n\n","status":"published","published":"2023-01-14T09:33:39.775Z","modified":"2024-08-02T10:13:49.411Z","cwes":["CWE-436"],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-0383","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`\n\n\n","status":"published","published":"2023-01-14T09:33:39Z","modified":"2024-08-02T10:13:49Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"none"}],"updated_at":"2026-11-03T03:50:07.959006Z"}],"ghsa":[{"id":"GHSA-7cxr-h8wm-fg4c","title":"Apache Shiro Interpretation Conflict vulnerability","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher` ","status":"published","published":"2023-01-14T12:30:23Z","modified":"2023-08-31T18:47:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2023-22602","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`\n\n\n","status":"published","published":"2023-01-14T10:15:09.14Z","modified":"2026-06-17T05:35:43.13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"DEBIAN-CVE-2023-22602","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.  The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`","status":"published","published":"2023-01-14T10:15:09.14Z","modified":"2026-10-26T18:01:36.633708335Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-7cxr-h8wm-fg4c","title":"Apache Shiro Interpretation Conflict vulnerability","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher` ","status":"published","published":"2023-01-14T12:30:23Z","modified":"2024-02-16T08:23:48.417435Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T15:46:41.002603Z"},{"id":"CVE-2023-22602","title":"Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request","description":"When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003c 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`\n\n\n","status":"published","published":"2023-01-14T09:33:39.775Z","modified":"2026-10-28T02:30:56.715629266Z","cwes":["CWE-436"],"updated_at":"2026-11-02T15:44:30.334753Z"}]}}