CVE-2016-4437
Fixed in a distro release ExploitedEPSS 93%CVSS 9.8
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Products: apache aurora, apache shiro, redhat fuse, redhat jboss_middleware_text-only_advisories
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.shiro:shiro-core | 1.2.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | shiro | 1.2.5-1 |
| Debian 13 | shiro | 1.2.5-1 |
| Debian 14 | shiro | 1.2.5-1 |
| Ubuntu Pro 16.04 LTS | shiro | 1.2.4-1ubuntu0.1~esm1 |