CVE-2016-4437

CRITICALCISA KEV

9.8

Beschreibung

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht6/7/2016

Zuletzt geandert10/22/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerApache

ProduktShiro

SchwachstellennameApache Shiro Code Execution Vulnerability

KEV Aufnahmedatum2021-11-03

Behebungsfrist2022-05-03

Ransomware-NutzungUnknown

Betroffene Produkte

apache:auroraapache:shiroredhat:fuseredhat:jboss_middleware_text-only_advisories

Schwachen (CWE)

CWE-321

Referenzen

http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html(secalert@redhat.com)

http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-2035.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-2036.html(secalert@redhat.com)

http://www.securityfocus.com/archive/1/538570/100/0/threaded(secalert@redhat.com)

http://www.securityfocus.com/bid/91024(secalert@redhat.com)

https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E(secalert@redhat.com)

http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html(af854a3a-2127-422b-91ae-364da2661108)

http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-2035.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-2036.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/538570/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/91024(af854a3a-2127-422b-91ae-364da2661108)

https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.