CVE-2023-46750: 
Java vulnerability analysis and mitigation

A URL Redirection to Untrusted Site ('Open Redirect') vulnerability was discovered in Apache Shiro when using 'form' authentication. The vulnerability affects Apache Shiro versions before 1.13.0 and versions 2.0.0-alpha-1 through 2.0.0-alpha-3. This security issue was disclosed on December 14, 2023 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on both confidentiality and integrity, while availability is not affected (NVD).

Successful exploitation of this vulnerability could lead to the disclosure of sensitive information or the addition or modification of data. The vulnerability allows remote attackers to redirect legitimate users to malicious websites (NetApp Security).

The vulnerability is publicly known and has been discussed in security communities. It requires network access and user interaction for successful exploitation (NetApp Security).

Users are advised to update to Apache Shiro version 1.13.0 or later, or to version 2.0.0-alpha-4 or later for those using the alpha releases (CVE).