Apache Shiro Observable Timing Discrepancy Vulnerability Allowing Username Enumeration

A timing discrepancy vulnerability has been identified in Apache Shiro versions 1.* and 2.* prior to 2.0.7. This vulnerability allows a brute-force attack to determine valid usernames by timing requests to see if they failed due to a non-existent user or an incorrect password. The issue arises because the response times for these two scenarios are different enough to be noticeable. The vulnerability is likely exploitable only in a local context.

Impact

Exploitation of this vulnerability could lead to username enumeration, allowing an attacker to identify valid usernames on the system.

Remediation

Users are advised to upgrade to Apache Shiro version 2.0.7 or later, which addresses this vulnerability.