Skip to main content
IMMUNITYSEC

CVE-2016-4437

9.8
CRITICAL
CVSS 3.1
EPSS 93.0% · 100th pctCISA KEV · Exploited in the wild
2016-06-07•Updated 2025-10-21•KEV 2021-11-03
CISA Known Exploited Vulnerabilities

Apache Shiro Code Execution Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2021-11-03
Remediation due
2022-05-03

Required action
Apply updates per vendor instructions.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2016-4437

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Severity

CVSS 3.1 · CISA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
--
n/a

References

7 Links
Vulnerability databases

Record Details

Published
2016-06-07
Last updated
2025-10-21
Assigner (CNA)
redhat
Credited to
-

More from Apache

All Apache CVEs→
CVE-2021-4422810 CRITICAL

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Apache Software FoundationKEVEPSS 100.0%2021-12-10
CVE-2017-56389.8 CRITICAL

Apache Struts Remote Code Execution Vulnerability

Apache Software FoundationKEVEPSS 100.0%2017-03-11
CVE-2021-404389 CRITICAL

mod_proxy SSRF

Apache Software FoundationKEVEPSS 100.0%2021-09-16
CVE-2013-22519.8 CRITICAL

Apache Struts Improper Input Validation Vulnerability

KEVEPSS 100.0%2013-07-18

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.