What is GHSA-hhw5-c326-822h?

GHSA-hhw5-c326-822h is a security advisory published by GitHub Security Advisories with Medium severity. Open redirect in Apache Shiro

Which CVE IDs does GHSA-hhw5-c326-822h cover?

GHSA-hhw5-c326-822h covers the following CVE IDs: CVE-2023-46750. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hhw5-c326-822h?

GHSA-hhw5-c326-822h has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-hhw5-c326-822h?

GHSA-hhw5-c326-822h affects 2 products, including: maven/org.apache.shiro:shiro-web:\u003c 1.13.0; maven/org.apache.shiro:shiro-web:\u003e= 2.0.0-alpha-1, \u003c 2.0.0-alpha-4.

GHSA-hhw5-c326-822hMediumCVSS 6.1

Open redirect in Apache Shiro

Vendor

GitHub Security Advisories

Published

December 14, 2023

Last Modified

November 4, 2025

🔗 CVE IDs covered (1)

CVE-2023-46750 →

📋 Description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

🎯 Affected products2

maven/org.apache.shiro:shiro-web:< 1.13.0
maven/org.apache.shiro:shiro-web:>= 2.0.0-alpha-1, < 2.0.0-alpha-4

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2023-46750
https://lists.apache.org/thread/hoc9zdyzmmrfj1zhctsvvtx844tcq6w9
https://github.com/apache/shiro/commit/3b80f5c8e5a95ba31e92e4825ecc0ba3148b555a
https://github.com/apache/shiro/commit/8400d08d5eac0bc4fae99d28c5adc82dd8a86eda
https://security.netapp.com/advisory/ntap-20240808-0002
https://security.netapp.com/advisory/ntap-20241108-0002
https://github.com/advisories/GHSA-hhw5-c326-822h