CVE-2016-4437 Improper Access Control in Apache Shiro
CriticalCVSS 9.8
EPSS 93.0%
CISA KEV
added 2021-11-03 · due 2022-05-03
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.shiro/shiro-core(Maven) | < 1.2.5 | 1.2.5 |
| org.apache.shiro/shiro-core(Maven) | = 1.0.0-incubating | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.1.0 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.2.0 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.2.1 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.2.2 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.2.3 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | = 1.2.4 | No fix listed |
| debian/shiro(Debian:12) | < 1.2.5-1 | 1.2.5-1 |
| debian/shiro(Debian:13) | < 1.2.5-1 | 1.2.5-1 |
| debian/shiro(Debian:14) | < 1.2.5-1 | 1.2.5-1 |
| apache aurora | >= 0.10.0, < 0.18.1 | 0.18.1 |
| apache shiro | < 1.2.5 | 1.2.5 |
| redhat fuse | = 1.0 | No fix listed |
| redhat jboss middleware text-only advisories | = 1.0 | No fix listed |
| org.apache.shiro/shiro-core(Maven) | <= 1.2.4 | No fix listed |
References
- Debian Security Tracker CVE-2016-4437 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- [announcements@aurora.apache.org] 20171101 Apache Aurora information disclosure vulnerability mailing-list
- lists.apache.org
- www.cisa.gov government-resource us-government-resource
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- RHSA-2016:2035 third-party-advisory vendor-advisory
- RHSA-2016:2036 third-party-advisory vendor-advisory
- 20160603 [Announce] CVE-2016-4437: Apache Shiro information disclosure vulnerability broken-link mailing-list third-party-advisory vdb-entry
- 91024 broken-link third-party-advisory vdb-entry
- github.com