CVE-2016-6802

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539397/100/0/threaded
http://www.securityfocus.com/bid/92947Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.htmlThird Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539397/100/0/threaded
http://www.securityfocus.com/bid/92947Third Party Advisory, VDB Entry

Timeline

Published: Sep 20, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-68037.8An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Wind CVE-2016-68047.8The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operati CVE-2016-68055.9Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.CVE-2016-68068.8Apache Wicket 6.x before 6.25.0, 7.x before 7.5.0, and 8.0.0-M1 provide a CSRF prevention measure that fails to discover some cross origin r CVE-2016-68079.8Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operati CVE-2016-68089.8Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42.CVE-2016-68099.8Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JM CVE-2016-68106.1In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based admi CVE-2016-68118.8In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.CVE-2016-68126.1The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page whi CVE-2016-68139.8Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API. If a malicious CVE-2016-68149.8When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standar