CVE-2016-4437

CRITICAL9.8⚠ KEVEPSS 94.3%

Improper Access Control in Apache Shiro

Published: 5/14/2022Modified: 4/28/2026Added to CISA KEV: 11/3/2021

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1CRITICAL9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

References (11)