Closed mend-bolt-for-github[bot] closed 8 months ago
Shiro is updated to 1.13.0 in commit https://github.com/moqui/moqui-framework/commit/62b98b28438013e6bf6353da39b9ae84250c5a1d
Note that moqui-framework does not use the Shiro functionality that can result in a redirect (just uses certain parts of the web API) so this is not an issue with OOTB moqui (changes to use shiro in this way could expose this vulnerability).
CVE-2023-46750 - Medium Severity Vulnerability
Library home page: https://shiro.apache.org/
Dependency Hierarchy: - :x: **shiro-web-1.12.0.jar** (Vulnerable Library)
Found in HEAD commit: 62b98b28438013e6bf6353da39b9ae84250c5a1d
Found in base branch: master
URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.
Publish Date: 2023-12-14
URL: CVE-2023-46750
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-hhw5-c326-822h
Release Date: 2023-12-14
Fix Resolution: org.apache.shiro:shiro-all:1.13.0, org.apache.shiro:shiro-web:1.13.0
Step up your Open Source Security Game with Mend here