| Vulnerability Name: | CVE-2016-4437 (CCN-113764) | ||||||||||||||||||||||||||||||||||||
| Assigned: | 2016-06-03 | ||||||||||||||||||||||||||||||||||||
| Published: | 2016-06-03 | ||||||||||||||||||||||||||||||||||||
| Updated: | 2018-10-09 | ||||||||||||||||||||||||||||||||||||
| Summary: | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. | ||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
6.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-284 | ||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2016-4437 Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html Source: MISC Type: UNKNOWN http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html Source: CCN Type: RHSA-2016-2035 Important: Red Hat JBoss Fuse 6.3 security update Source: REDHAT Type: UNKNOWN RHSA-2016:2035 Source: CCN Type: RHSA-2016-2036 Important: Red Hat JBoss A-MQ 6.3 security update Source: REDHAT Type: UNKNOWN RHSA-2016:2036 Source: CCN Type: Apache Web site Shiro Source: BUGTRAQ Type: UNKNOWN 20160603 [Announce] CVE-2016-4437: Apache Shiro information disclosure vulnerability Source: BID Type: UNKNOWN 91024 Source: XF Type: UNKNOWN apache-shiro-cve20164437-code-exec(113764) Source: MLIST Type: UNKNOWN [announcements@aurora.apache.org] 20171101 Apache Aurora information disclosure vulnerability Source: CCN Type: Packet Storm Security [04-29-2020] Apache Shiro 1.2.4 Remote Code Execution Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY KNOWN EXPLOITED VULNERABILITIES CATALOG Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [05-01-2020] Source: CCN Type: IBM Security Bulletin 6491163 (Planning Analytics) IBM Planning Analytics Workspace is affected by security vulnerabilities Source: CCN Type: WhiteSource Vulnerability Database CVE-2016-4437 | ||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||