← CVE Radar
CVE-2016-4437Apache Shiro Code Execution Vulnerability
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
9.8 CRITICALEPSS 93.03%⚡ Known Exploited (CISA KEV)NVD: Published
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2016-4437
- Status
- Published
- Assigner (CNA)
- redhat
- Published
- Jun 7, 2016
- Last modified
- 2025-10-21 23:55 UTC
- Weaknesses
Affected Products
No affected products have been published for this CVE yet.
References
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2035.html
- lists.apache.org https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E
- packetstormsecurity.com http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
- rhn.redhat.com http://rhn.redhat.com/errata/RHSA-2016-2036.html
- securityfocus.com http://www.securityfocus.com/bid/91024
- securityfocus.com http://www.securityfocus.com/archive/1/538570/100/0/threaded
- packetstormsecurity.com http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
Sources
- NVD (unavailable at last refresh)
- CVE.org
- CISA KEV
- FIRST EPSS