Vulnerability	Vulnerable Version
H Authentication Bypass by Alternate Name org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name in the `shiro-guice` module when deployed in a web servlet context. An attacker can gain unauthorized access by sending specially crafted HTTP requests. How to fix Authentication Bypass by Alternate Name? Upgrade `org.apache.shiro:shiro-web` to version 3.0.0 or higher.	[2.0.0-alpha-1,3.0.0)
L Replay Attack org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the `RememberMe` cookie. An attacker can maintain unauthorized access by intercepting and reusing a valid cookie beyond its intended expiration. This is only exploitable if the RememberMe functionality is enabled. How to fix Replay Attack? Upgrade `org.apache.shiro:shiro-web` to version 3.0.0 or higher.	[1.2.4,3.0.0)

Authentication Bypass by Alternate Name

org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management.

Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name in the shiro-guice module when deployed in a web servlet context. An attacker can gain unauthorized access by sending specially crafted HTTP requests.

How to fix Authentication Bypass by Alternate Name?

Upgrade org.apache.shiro:shiro-web to version 3.0.0 or higher.

[2.0.0-alpha-1,3.0.0)

Replay Attack

org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management.

Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the RememberMe cookie. An attacker can maintain unauthorized access by intercepting and reusing a valid cookie beyond its intended expiration. This is only exploitable if the RememberMe functionality is enabled.

How to fix Replay Attack?

Upgrade org.apache.shiro:shiro-web to version 3.0.0 or higher.

[1.2.4,3.0.0)

Go back to all versions of this package