CVE-2010-3863 json
Apache Shiro Path Traversal vulnerability
published 2010-11-05 16 y ago modified 2026-06-16 4 mo ago also GHSA-3jx9-mgwx-4q83 , EUVD-2022-2205
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 54.5%
- EPSS 54.5% chance of exploitation in 30 days, percentile 99%
- public exploits
- 1
- Exploit-DB
Summary
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Patch / fix
- maven org.apache.shiro:shiro-root 1.1.0
Timeline
- First public exploit (EDB-34952)
- Published
Exploit prediction
54.52% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-34952 Apache Shiro - Directory Traversal remote, 2010-11-02
- securityfocus.com http://www.securityfocus.com/bid/44616 referenced PoC, tagged "exploit" by a source, unverified
- archives.neohapsis.com http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.shiro:shiro-root | <1.1.0 |
1.1.0 |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
securityfocus.com
/bid/44616
vdb-entry, exploit
-
archives.neohapsis.com
/archives/fulldisclosure/2010-11/0020.html
mailing-list, web, exploit
-
secunia.com
/advisories/41989
third-party-advisory, vendor-advisory
-
osvdb.org
/69067
vdb-entry
-
securityfocus.com
/archive/1/514616/100/0/threaded
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/62959
vdb-entry, web
-
vupen.com
/english/advisories/2010/2888
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2010-3863
advisory
-
github.com
/apache/shiro
package
-
web.archive.org
/web/20101120091718/http://www.vupen.com/english/advisories/2010/2888
web
-
web.archive.org
/web/20101129043410/http://secunia.com/advisories/41989
web
-
web.archive.org
/web/20110929165859/http://www.securityfocus.com/bid/44616
web
-
web.archive.org
/web/20161017000748/http://www.securityfocus.com/archive/1/514616/100/0/threaded
web
Sources
- CVE List CVE-2010-3863
- GitHub Advisory GHSA-3jx9-mgwx-4q83
- NVD CVE-2010-3863
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.