NetSight
IP …
critical9.8Known exploitedPublic exploit code

CVE-2016-4437

Apache Shiro Code Execution Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected products

VendorProductAffected versions
ApacheAurora
from 0.10.0 before 0.18.1
ApacheShiro
before 1.2.5
RedhatFuse
Version 1.0
RedhatJboss Middleware Text-Only Advisories
Version 1.0

Weakness classification

CWE-321

References