CVE-2016-4437

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the remember me feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

94.214

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2016-4437 are fixed in Apache - Shiro Core 1.2.5	Windows
Vulnerabilities CVE-2016-4437 are fixed in Apache - Shiro Core for Linux 1.2.5	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234