CVE-2016-4437

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2021-11-03Remediation due 2022-05-03

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

9.8

CVSS

93.0%

EPSS (exploit prob.)

100th

EPSS percentile

2016-06-07

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-321

Affected products

Vendor	Product	Affected versions
apache	aurora	>= 0.10.0, < 0.18.1
apache	shiro	< 1.2.5
redhat	fuse	1.0
redhat	jboss_middleware_text-only_advisories	1.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2016-4437