$ cve CVE-2016-4437 JSON

CVE-2016-4437 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 93% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	93.04% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-321
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	yes
Published	2016-06-07
Last modified	2026-06-17

CISA KEV

Name	Apache Shiro Code Execution Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	Apache / Shiro
Ransomware use	none reported

Affected (4)

Vendor	Product
apache	aurora
apache	shiro
redhat	fuse
redhat	jboss middleware text-only advisories

Public exploits

Source	Title	Date
exploit-db	Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit)	2020-05-01

References

→ the Explorer · watch your stack · NVD