CVE-2023-46750

Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

State: Published
Severity: 4.7 Medium
Published: Dec 14, 2023
Updated: Nov 3, 2025
Reserved: Oct 25, 2023

Read the record on cve.org

Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
Apache ShiroApache Software Foundation	before 1.13.0Affected 2.0.0-alpha-1 to before 2.0.0-alpha-4Affected

References

https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9vendor-advisory
https://security.netapp.com/advisory/ntap-20240808-0002/
https://security.netapp.com/advisory/ntap-20241108-0002/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.