CVE-2010-3863
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2010-3863
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Shiro路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Shiro/Jsecurity都是强大、灵活的Java开源安全框架。 Apache Shiro 1.1.0版本，以及Jsecurity 0.9.x在执行路径匹配之前没有规范URI路径。远程攻击者可以借助特制请求绕过预设的访问限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2010-3863
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Shiro%20%E8%AE%A4%E8%AF%81%E7%BB%95%E8%BF%87%E6%BC%8F%E6%B4%9E%20CVE-2010-3863.md | POC Details |
| 2 | https://github.com/vulhub/vulhub/blob/master/shiro/CVE-2010-3863/README.md | POC Details | |
| 3 | shiro 路径穿越 | https://github.com/sh1inroot-alt/shiro-cve-2010-3863 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2010-3863
请登录查看更多情报信息。
- http://archives.neohapsis.com/archives/fulldisclosure/2010-11/0020.htmlmailing-listx_refsource_FULLDISC
- https://nvd.nist.gov/vuln/detail/CVE-2010-3863
Same Patch Batch · n/a · 2010-11-05 · 37 CVEs total
| CVE-2010-1523 | Nullsoft Winamp 'vp6.w5s'堆缓冲区溢出漏洞 | |
| CVE-2010-4201 | Google Chrome释放后使用漏洞 | |
| CVE-2010-4202 | Google Chrome多个整数溢出漏洞 | |
| CVE-2010-4203 | Google Chrome WebM libvpx缓冲区错误漏洞 | |
| CVE-2010-4204 | Google Chrome WebKit拒绝服务漏洞 | |
| CVE-2010-4205 | Google Chrome事件对象输入验证错误漏洞 | |
| CVE-2010-4206 | Google Chrome WebKit SVG文档数组索引错误漏洞 | |
| CVE-2009-5014 | TurboGears2授权问题漏洞 | |
| CVE-2009-5015 | TurboGears2 URL调度机制未明漏洞 | |
| CVE-2010-4199 | Google Chrome SVG使用元素输入验证错误漏洞 | |
| CVE-2010-2477 | Pythonpaste Paste paste.httpexceptions实现多个跨站脚本攻击漏洞 | |
| CVE-2010-3852 | Red Hat Conga Luci授权问题漏洞 | |
| CVE-2010-3915 | JustSystems Ichitaro和Ichitaro Government任意代码执行漏洞 | |
| CVE-2010-3916 | JustSystems Ichitaro 安全漏洞 | |
| CVE-2010-3998 | Banshee LD_LIBRARY_PATH设计错误漏洞 | |
| CVE-2010-4000 | GNOME Shell LD_LIBRARY_PATH权限许可和访问控制漏洞 | |
| CVE-2010-4001 | Gromacs 权限许可和访问控制漏洞 | |
| CVE-2010-4005 | GNOME Tomboy代码注入漏洞 | |
| CVE-2010-4184 | NetSupport Manager HTTP头加密问题漏洞 | |
| CVE-2010-3172 | Mozilla Bugzilla CRLF代码注入漏洞 |
Showing top 20 of 37 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2010-3863
No comments yet