Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.7147.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-7147-1)
Summary:	The remote host is missing an update for the 'shiro' package(s) announced via the USN-7147-1 advisory.
Description:	Summary: The remote host is missing an update for the 'shiro' package(s) announced via the USN-7147-1 advisory. Vulnerability Insight: It was discovered that Apache Shiro incorrectly handled path traversal when used with other web frameworks or path rewriting. An attacker could possibly use this issue to obtain sensitive information or administrative privileges. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-34478, CVE-2023-46749) It was discovered that Apache Shiro incorrectly handled web redirects when used together with the form authentication method. An attacker could possibly use this issue to perform phishing attacks. This update provides the corresponding fix for Ubuntu 24.04 LTS and Ubuntu 24.10. (CVE-2023-46750) It was discovered that Apache Shiro incorrectly handled requests through servlet filtering. An attacker could possibly use this issue to obtain administrative privileges. This update provides the corresponding fix for Ubuntu 16.04 LTS. (CVE-2016-6802) Affected Software/OS: 'shiro' package(s) on Ubuntu 16.04, Ubuntu 24.04, Ubuntu 24.10. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-6802 BugTraq ID: 92947 http://www.securityfocus.com/bid/92947 Bugtraq: 20160913 [ANNOUNCE][CVE-2016-6802] Apache Shiro 1.3.2 released (Google Search) http://www.securityfocus.com/archive/1/539397/100/0/threaded http://packetstormsecurity.com/files/138709/Apache-Shiro-Filter-Bypass.html Common Vulnerability Exposure (CVE) ID: CVE-2023-34478 https://lists.apache.org/thread/mbv26onkgw9o35rldh7vmq11wpv2t2qk http://www.openwall.com/lists/oss-security/2023/07/24/4 Common Vulnerability Exposure (CVE) ID: CVE-2023-46749 https://lists.apache.org/thread/mdv7ftz7k4488rzloxo2fb0p9shnp9wm Common Vulnerability Exposure (CVE) ID: CVE-2023-46750 https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.