9.8crit
CVE-2016-4437KEVin critical feed1 exploit
Improper Access Control in Apache Shiro
Also known as GHSA-p836-389h-j692
Published 10 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
93.0%
percentile 100%
Public exploits
1
Exploit-DB
Summary
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Known exploited (CISA KEV)
- Added
- 5 y ago
- Due date
- 2022-05-03 (4 y ago)
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Apache / Shiro
- CISA name
- Apache Shiro Code Execution Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
93.04% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- EDB-48410 Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit) · remote · 2020-05-01
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.shiro:shiro-core | <1.2.5 | 1.2.5 |
Classification
References
- rhn.redhat.com /errata/RHSA-2016-2035.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- lists.apache.org /thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.a · mailing-list, x_refsource_MLIST, x_transferred
- packetstormsecurity.com /files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html · x_refsource_MISC, x_transferred
- rhn.redhat.com /errata/RHSA-2016-2036.html · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/91024 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/538570/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- packetstormsecurity.com /files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html · x_refsource_MISC, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437 · government-resource
- nvd.nist.gov /vuln/detail/CVE-2016-4437 · advisory
- lists.apache.org /thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4@%3Cannouncements.aur · web
Sources
- CVE List: CVE-2016-4437
- GitHub Advisory: GHSA-p836-389h-j692
- NVD: CVE-2016-4437
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.