CVE-2023-34478 - Authentication Bypass

Severity: Critical2023-11-09

Security Advisories

Abstract

Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update to Apache Shiro 1.12.0+ or 2.0.0-alpha-3+

The Oxygen products incorporate Apache Shiro as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen XML Web Author v25.1.0.1 and olderCritical Oxygen XML Web Author 26.0.0 build 2023101015
Oxygen Content Fusion v5.1.1 and olderCritical Oxygen Content Fusion 6.0 build 2023110109

Mitigation

None

Detail

CVE-2023-34478

Severity: Critical

CVSS Score: 9.8

The Apache Shiro third-party library used by Oxygen XML products is an affected version mentioned in CVE-2023-34478 vulnerability description.

Starting with Oxygen XML Web Author 26.0.0 build 2023101015 Apache Shiro library was updated to a version which fixes this vulnerability.

Starting with Oxygen Content Fusion 6.0 build 2023110109 Apache Shiro library was updated to a version which fixes this vulnerability.

List of Security Advisories