[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fydUxGdYYmBOQQ8-gGnA7ywthcuEUEQT6Tuul6xFp75g":3,"g5a-risk:CVE-2023-22602":107},{"success":4,"data":5,"meta":104},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":29,"epssPercentile":26,"epssTimeSeries":30,"severity":31,"affectedProducts":32,"affectedProductsCount":43,"references":44,"referencesCount":51,"weaknesses":52,"weaknessesCount":51,"isActivelyExploited":61,"cisaInfo":26,"otxData":26,"relatedBlogPosts":62,"seoMetadata":63,"configurations":88,"relatedVendorCves":102,"notableEvents":103},"CVE-2023-22602","What is CVE-2023-22602?","When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.\n\nThe authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot \u003C 2.6 default to Ant style pattern matching.\nMitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value:  `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`","When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication...","2023-01-14T10:15:09.14","2023-11-07T04:07:06.053",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":26,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":25,"AvailabilityImpact":23,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":23,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,3.9,3.6,0.01553,[29,29,29,29,29,29,29],"High",[33,38],{"vendor":34,"product":35,"version":36,"criteria":37,"vulnerable":4},"apache","shiro","*","cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*",{"vendor":39,"product":40,"version":41,"criteria":42,"vulnerable":4},"vmware","spring_boot","2.6.0","cpe:2.3:a:vmware:spring_boot:2.6.0:\\+:*:*:*:*:*:*",2,[45],{"url":46,"source":47,"tags":48},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fdzj0k2smpzzgj6g666hrbrgsrlf9yhkl","Apache",[49,50],"Mailing List","Vendor Advisory",1,[53],{"id":54,"name":55,"description":56,"extendedDescription":57,"status":58,"abstraction":59,"structure":60},"CWE-436","Interpretation Conflict","Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.","This is generally found in proxies, firewalls, anti-virus software, and other intermediary devices that monitor, allow, deny, or modify traffic based on how the client or server is expected to behave.","Incomplete","Class","Simple",false,[],{"title":64,"metaDescription":65,"keywords":66,"canonicalUrl":67,"structuredData":68},"What is CVE-2023-22602? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2023-22602, a high severity cyber security vulnerability from 2023. When using Apache Shiro before 1.11.0 together with Spring ...","CVE-2023-22602, CVE-2023-22602 vulnerability, CVE-2023-22602 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2023, CVSS score, exploit, patch, remediation, apache security, vmware security, shiro vulnerability, spring_boot vulnerability","\u002Fwhat-is\u002Fcve-2023-22602",{"@context":69,"@type":70,"headline":64,"description":65,"datePublished":10,"dateModified":11,"author":71,"publisher":75,"about":79,"mainEntityOfPage":83,"articleSection":86,"keywords":87},"https:\u002F\u002Fschema.org","TechArticle",{"@type":72,"name":73,"url":74},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":72,"name":73,"url":74,"logo":76},{"@type":77,"url":78},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":80,"name":6,"description":81,"additionalType":82},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":84,"@id":85},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2023-22602","Cybersecurity","CVE-2023-22602, CVE-2023-22602 vulnerability, CVE-2023-22602 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[89],{"Operator":90,"Negate":26,"Nodes":91},"AND",[92,98],{"Operator":93,"Negate":26,"CPEMatch":94},"OR",[95],{"Vulnerable":4,"Criteria":37,"MatchCriteriaID":96,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":97,"VersionEndIncluding":26},"A43087B9-1941-4A90-AF30-331C19BF9A87","1.11.0",{"Operator":93,"Negate":26,"CPEMatch":99},[100],{"Vulnerable":4,"Criteria":42,"MatchCriteriaID":101,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"74809806-E086-4EFF-8268-3EFF39AB5EF4",[],[],{"lastModified":11,"cacheTime":105,"version":106},1792364750865,"2.0",{"score":108,"band":109,"action":110,"scoredAt":111},47,"Medium","Plan remediation","2026-10-16T06:56:51.614727+00:00"]