CVE-2025-45611: Vulnerable Apache Shiro Version Auth Bypass
Apache Shiro is pinned to a version prior to 1.5.3 in this pom.xml. Versions 1.0.0-incubating through 1.5.2 are affected by an authentication bypass (CVE-2020-1957 and related, including the class of bug behind CVE-2025-45611 in hope-boot) caused by a path-normalization discrepancy between Shiro's filter chain and Spring MVC. An unauthenticated attacker can
greprules fetch cve-2025-45611-vulnerable-apache-shiro-version-auth-bypass --engine opengrepDescription
Apache Shiro is pinned to a version prior to 1.5.3 in this pom.xml. Versions 1.0.0-incubating through 1.5.2 are affected by an authentication bypass (CVE-2020-1957 and related, including the class of bug behind CVE-2025-45611 in hope-boot) caused by a path-normalization discrepancy between Shiro's filter chain and Spring MVC. An unauthenticated attacker can
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.