CVE-2016-4437

Warnung

Exploit

EPSS 94.21%
Veröffentlicht 07.06.2016 14:06:13
Zuletzt bearbeitet 22.04.2026 14:36:05
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 1 Referenzen 11

NVD 4 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Apache ≫ Aurora Version >= 0.10.0 < 0.18.1

Apache ≫ Shiro Version < 1.2.5

Redhat ≫ Fuse Version1.0

Redhat ≫ Jboss Middleware Text-only Advisories Version1.0 SwPlatformmiddleware

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Apache Shiro Code Execution Vulnerability

Schwachstelle

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	94.21%	0.999

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P
134c704f-9b21-4f2e-91b3-4a467353bcc0	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H