Apache Shiro Jakarta Ee Module
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_shiro_jakarta_ee_module:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Shiro Jakarta Ee Module (bad5547b-d99f-52bc-99cb-7c323a9e84a4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44598 |
vulnerable | 2026-06-08 08:05:11.214138 |
Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)
With valid login credentials, URL Redirection to Untrusted Site ('Open Redirect'), Server-Side Request Forgery (SSRF) vulnerability in Apache Shiro.
This issue affects Apache Shiro from 2.0-alpha to 2.1.0, and 3.0.0-alpha-1, only when using shiro-jakarta-ee integration module.
Users are recommended to upgrade to version 2.1.1, or 3.0.0-alpha-2 or later, which fixes the issue by encrypting the cookie.
After successful login, Jakarta EE integration module uses shiroSavedRequest cookie to redirect to a particular web page after login.
This cookie was not validated, and can be forged to send a HTTP GET request from the server itself to an arbitrary URL from the cookie.
Published: 2026-05-25T20:19:44.317Z
Updated: 2026-05-26T12:38:12.217Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.