CVE-2023-22602

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.

The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-436

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Shiro	—

References

https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhklMailing List, Vendor Advisory
https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhklMailing List, Vendor Advisory
https://security.netapp.com/advisory/ntap-20230302-0001/

Timeline

Published: Jan 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22614.3The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_ajax_call fun CVE-2023-226107.5A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messag CVE-2023-226117.5A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when spec CVE-2023-226128.8An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. A malicious host OS can invoke an Insyde SMI handler wi CVE-2023-226138.8An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. It is possible to write to an attacker-controlled addre CVE-2023-226148.8An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There is insufficient input validation in BIOS Gua CVE-2023-226158.4An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI subfunction execution may corrupt SMRAM. An attac CVE-2023-226167.8An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. The Save State register is not checked before use. The IhisiSmm dri CVE-2023-226177.5A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misco CVE-2023-226187.8If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative CVE-2023-22629.8A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could CVE-2023-226207.5An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows sessionid information disclosure vi