{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44598.json" } ], "title": "shiro: org.apache.shiro/shiro-jakarta-ee: Apache Shiro: Server-Side Request Forgery via forged shiroSavedRequest cookie", "tracking": { "current_release_date": "2026-06-29T05:57:19+00:00", "generator": { "date": "2026-06-29T05:57:19+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "CVE-2026-44598", "initial_release_date": "2026-05-25T20:19:44.317000+00:00", "revision_history": [ { "date": "2026-05-25T20:19:44.317000+00:00", "number": "1", "summary": "Initial version" }, { "date": "2026-06-29T05:52:59+00:00", "number": "2", "summary": "Current version" }, { "date": "2026-06-29T05:57:19+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product": { "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack", "product_identification_helper": { "cpe": "cpe:/a:redhat:jbosseapxp" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform Expansion Pack" }, { "category": "product_version", "name": "shiro-jakarta-ee", "product": { "name": "shiro-jakarta-ee", "product_id": "shiro-jakarta-ee", "product_identification_helper": { "purl": "pkg:maven/org.apache.shiro/shiro-jakarta-ee" } } } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "shiro-jakarta-ee as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack", "product_id": "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee" }, "product_reference": "shiro-jakarta-ee", "relates_to_product_reference": "red_hat_jboss_enterprise_application_platform_expansion_pack" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-44598", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2026-05-25T21:00:59.712267+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2481290" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Shiro, specifically within the shiro-jakarta-ee integration module. A remote attacker with valid login credentials could exploit this vulnerability by forging the shiroSavedRequest cookie. This unvalidated cookie can be manipulated to send an HTTP GET request from the server to an arbitrary external URL, leading to Server-Side Request Forgery (SSRF). This allows an attacker to trick the server into making requests to internal or external resources on their behalf, potentially leading to information disclosure or further attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "shiro: org.apache.shiro/shiro-jakarta-ee: Apache Shiro: Server-Side Request Forgery via forged shiroSavedRequest cookie", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2026-44598" }, { "category": "external", "summary": "RHBZ#2481290", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481290" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44598", "url": "https://www.cve.org/CVERecord?id=CVE-2026-44598" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44598", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44598" }, { "category": "external", "summary": "https://shiro.apache.org/security-reports.html#cve_2026_44598", "url": "https://shiro.apache.org/security-reports.html#cve_2026_44598" } ], "release_date": "2026-05-25T20:19:44.317000+00:00", "remediations": [ { "category": "none_available", "details": "Fix deferred", "product_ids": [ "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1" }, "products": [ "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee" ] } ], "threats": [ { "category": "impact", "details": "Moderate", "product_ids": [ "red_hat_jboss_enterprise_application_platform_expansion_pack:shiro-jakarta-ee" ] } ], "title": "shiro: org.apache.shiro/shiro-jakarta-ee: Apache Shiro: Server-Side Request Forgery via forged shiroSavedRequest cookie" } ] }