Details
-
Fix
-
Status: Released (View Workflow)
-
Minor
-
Resolution: Fixed
-
1.13.10
-
None
-
None
-
CVE-2022-32532
Description
Current Situation
- Currently JOC Cockpit uses org.apache.shiro:shiro-core version 1.7.1
- a vulnerability affects this version,
- The criticality of this shiro vulnerability as used in JOC Cockpit is seen as low as the szenario in which the vulnerability can be exploited is not supported in the JOC Cockpit product.
- seeĀ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32532
Desired Behavior
- Due to a vulnerability Issue of older org.apache.shiro:shiro-core releases the JOC Cockpit should use the current version 1.9.1 that fixes the issues.