CyberRota Analysis
AI-GeneratedApache Shiro versions 2.x through 3.0.0, when used with the Jakarta EE integration module, are vulnerable to a low-privileged user crafting an HTTP request that can force the server to connect to an attacker-controlled URL, potentially leaking sensitive data. Organizations utilizing these versions in their Jakarta EE deployments should prioritize upgrading to version 3.0.1 or later to mitigate this risk, or configure specific system properties to limit connections during form resubmissions.
Original NVD Description
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
Related CVEs
Other vulnerabilities affecting the same vendor(s)