CVE-2010-3863: Apache Shiro URI path canonicalization bypasses access restrictions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityThe flaw is trivially reachable without authentication, public exploit references exist, and EPSS is very high, though the direct impact is limited to partial information disclosure.

What it is

Apache Shiro before 1.1.0 and JSecurity 0.9.x compare request URIs to shiro.ini entries without canonicalizing the path first. A crafted URI such as /./account/index.jsp can therefore evade the configured path-based access rules. This matters because the filter chain that is supposed to protect restricted resources can be skipped entirely.

Impact

An attacker gains access to resources that the shiro.ini configuration intended to restrict, with the demonstrated case being read access to a protected account page. The CVSS vector indicates partial confidentiality impact only, with no integrity or availability effect.

Attack surface

Reachable remotely over the network by sending a crafted HTTP request containing a non-canonical path; the vector AV:N/AC:L/Au:N/C:P/I:N/A:N indicates no authentication and no user interaction are required.

Exploitation

Public exploit references exist (Full Disclosure and SecurityFocus BID 44616 are tagged Exploit), and EPSS is 0.54521 at the 98.965th percentile, but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Upgrade Apache Shiro to 1.1.0 or later, or migrate off JSecurity 0.9.x, which is the only complete fix.
• If immediate upgrade is not possible, place a front-end proxy or servlet filter that normalizes and rejects non-canonical request paths before they reach Shiro.
• Review shiro.ini filter chain definitions for path-based rules that can be bypassed by dot-segment or encoding tricks and tighten them.
• Restrict network access to protected application paths to trusted sources as a compensating control until patching is complete.

Detection

• Search web access logs for request URIs containing dot-segments such as /./, /../, or encoded equivalents like %2e%2e targeting protected paths.
• Alert on requests to restricted paths that return HTTP 200 where the baseline for unauthenticated access is a redirect or 403.
• Monitor for repeated probing of protected paths with path-manipulation variants from a single source.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.