CVE-2016-4437

9.8 CRITICAL CISA KEV - Actively Exploited

Published: June 07, 2016 Modified: October 22, 2025

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html

Source: secalert@redhat.com

Third Party Advisory VDB Entry

http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html

Source: secalert@redhat.com

Exploit Third Party Advisory VDB Entry

http://rhn.redhat.com/errata/RHSA-2016-2035.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2036.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/archive/1/538570/100/0/threaded

Source: secalert@redhat.com

Broken Link Third Party Advisory VDB Entry

http://www.securityfocus.com/bid/91024

Source: secalert@redhat.com

Broken Link Third Party Advisory VDB Entry

https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E

Source: secalert@redhat.com

Mailing List

http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html