CVE-2021-41303

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Apache Software FoundationApache Shiro>= Apache Shiro, < 1.8.0

References

Timeline

Published
Sep 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413046.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroCVE-2021-413057.5Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view the names of private projects and filterCVE-2021-413067.5Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to view private project and filter names via an CVE-2021-413077.5Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view the names of private projects and CVE-2021-413086.5Affected versions of Atlassian Jira Server and Data Center allow authenticated yet non-administrator remote attackers to edit the File RepliCVE-2021-413095.3Affected versions of Atlassian Jira Server and Data Center allow a user who has had their Jira Service Management access revoked to export aCVE-2021-41318.8livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-413106.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a CroCVE-2021-413117.5Affected versions of Atlassian Jira Server and Data Center allow attackers with access to an administrator account that has had its access rCVE-2021-413127.5Affected versions of Atlassian Jira Server and Data Center allow a remote attacker who has had their access revoked from Jira Service ManageCVE-2021-413134.3Affected versions of Atlassian Jira Server and Data Center allow authenticated but non-admin remote attackers to edit email batch configuratCVE-2021-413148.8Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the a