Apache · Shiro
CVE-2016-4437
Apache Shiro Code Execution Vulnerability
What it is
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CISA: Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- June 7, 2016
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 93% in the top 0.2% of all known vulnerabilities
- Weakness
- CWE-284
- More details
- NVD · CVE.org · CISA
All references (7)
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
- http://rhn.redhat.com/errata/RHSA-2016-2036.html
- https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannounceme…
- http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
- http://www.securityfocus.com/bid/91024
- http://www.securityfocus.com/archive/1/538570/100/0/threaded
- http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
More exploited flaws from Apache
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Oct 8, 2026 | Command Injection | Struts | High 8.1 | 97% |
| Aug 4, 2026 | Missing Encryption of Sensitive Data | Tomcat | High 7.5 | 99% |
| Apr 16, 2026 | Improper Input Validation | ActiveMQ | High 8.8 | 98% |
| May 1, 2025 | Improper Escaping of Output | HTTP Server | Critical 9.1 | >99.9% |
| Apr 1, 2025 | Path Equivalence | Tomcat | Critical 10.0 | 99.9% |
| Feb 4, 2025 | Forced Browsing | OFBiz | Critical 9.8 | >99.9% |
| Sep 18, 2024 | Improper Access Control | HugeGraph-Server | Critical 9.8 | 99.2% |
| Aug 27, 2024 | Incorrect Authorization | OFBiz | High 8.1 | 99.4% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.