Log in Start free

Actively exploited · Published Jun 7, 2016 · Assigned by redhat

CVE-2016-4437

Critical 9.8 Exploited

In plain English

A critical-severity security flaw in Shiro from Apache. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 93.0% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)93.0%top 0.2% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12shiro1.2.5-1DEBIAN-CVE-2016-4437
Debian:13shiro1.2.5-1DEBIAN-CVE-2016-4437
Debian:14shiro1.2.5-1DEBIAN-CVE-2016-4437
Mavenorg.apache.shiro:shiro-core1.2.5GHSA-p836-389h-j692

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References