CVE-2016-4437

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2035.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2036.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/538570/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91024Broken Link, Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3EMailing List
http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2035.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2036.htmlThird Party Advisory
http://www.securityfocus.com/archive/1/538570/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/91024Broken Link, Third Party Advisory, VDB Entry
https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3EMailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437US Government Resource

Timeline

Published: Jun 7, 2016
Last modified: Jun 17, 2026
Added to CISA KEV: Nov 3, 2021
NVD status: Analyzed

Related CVEs from 2016

CVE-2016-44389.8The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.CVE-2016-44396.7The esp_reg_write function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check command buffer l CVE-2016-44407.8arch/x86/kvm/vmx.c in the Linux kernel through 4.6.3 mishandles the APICv on/off state, which allows guest OS users to obtain direct APIC MS CVE-2016-44416.0The get_cmd function in hw/scsi/esp.c in the 53C9X Fast SCSI Controller (FSC) support in QEMU does not properly check DMA length, which allo CVE-2016-44425.3The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and object CVE-2016-44435.5Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive informa CVE-2016-44447.0The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux CVE-2016-44457.0The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering CVE-2016-44467.0The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial wit CVE-2016-44477.5The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-b CVE-2016-44489.8Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vect CVE-2016-44497.1XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validati