ByteOS Network

Vulnerability Details :

CVE-2016-4437

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-07 Jun, 2016 | 14:00

Updated At-30 Jul, 2025 | 01:46

Apache Shiro Code Execution Vulnerability

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Known Exploited Vulnerabilities (KEV)

cisa.gov

Vendor:

The Apache Software Foundation

Product:Shiro

Added At:03 Nov, 2021

Due At:03 May, 2022

Apache Shiro Code Execution Vulnerability

Used in Ransomware

Unknown

CWE

CWE-284

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2016-4437

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:07 Jun, 2016 | 14:00

Updated At:30 Jul, 2025 | 01:46

▼CVE Numbering Authority (CNA)

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://rhn.redhat.com/errata/RHSA-2016-2035.html	vendor-advisory x_refsource_REDHAT
https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E	mailing-list x_refsource_MLIST
http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html	x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2016-2036.html	vendor-advisory x_refsource_REDHAT
http://www.securityfocus.com/bid/91024	vdb-entry x_refsource_BID
http://www.securityfocus.com/archive/1/538570/100/0/threaded	mailing-list x_refsource_BUGTRAQ
http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html	x_refsource_MISC

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2035.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html

Resource:

x_refsource_MISC

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2036.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://www.securityfocus.com/bid/91024

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://www.securityfocus.com/archive/1/538570/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

Hyperlink: http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
http://rhn.redhat.com/errata/RHSA-2016-2035.html	vendor-advisory x_refsource_REDHAT x_transferred
https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E	mailing-list x_refsource_MLIST x_transferred
http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html	x_refsource_MISC x_transferred
http://rhn.redhat.com/errata/RHSA-2016-2036.html	vendor-advisory x_refsource_REDHAT x_transferred
http://www.securityfocus.com/bid/91024	vdb-entry x_refsource_BID x_transferred
http://www.securityfocus.com/archive/1/538570/100/0/threaded	mailing-list x_refsource_BUGTRAQ x_transferred
http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html	x_refsource_MISC x_transferred

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2035.html

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-2036.html

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://www.securityfocus.com/bid/91024

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://www.securityfocus.com/archive/1/538570/100/0/threaded

Resource:

mailing-list

x_refsource_BUGTRAQ

x_transferred

Hyperlink: http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-321	CWE-321 Use of Hard-coded Cryptographic Key

Type: CWE

CWE ID: CWE-321

Description: CWE-321 Use of Hard-coded Cryptographic Key

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2021-11-03

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437

Timeline

Event	Date
CVE-2016-4437 added to CISA KEV	2021-11-03 00:00:00

Event: CVE-2016-4437 added to CISA KEV

Date: 2021-11-03 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:07 Jun, 2016 | 14:06

Updated At:12 Apr, 2025 | 10:46

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2022-05-03	Apache Shiro Code Execution Vulnerability	Apply updates per vendor instructions.

Date Added: 2021-11-03

Due Date: 2022-05-03

Vulnerability Name: Apache Shiro Code Execution Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

The Apache Software Foundation

>>aurora>>Versions from 0.10.0(inclusive) to 0.18.1(exclusive)

cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>shiro>>Versions before 1.2.5(exclusive)

cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>fuse>>1.0

cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>jboss_middleware_text-only_advisories>>1.0

cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-321	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-321

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0