Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-22602 Details

Description

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl CVEMailing ListVendor Advisory
https://security.netapp.com/advisory/ntap-20230302-0001/ CVE
https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl [email protected]Mailing ListVendor Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-436Interpretation Conflict[email protected]

Affected Products

ProductVersions
apache shiro
< 1.11.0

CPE

  • cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
vmware spring boot
2.6.0 +

CPE

  • cpe:2.3:a:vmware:spring_boot:2.6.0:+:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-22602
NVD Published Date:
Jan 14, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]