{"id":"CVE-2019-12422","published":"2019-11-18T22:04:21Z","modified":"2024-08-04T23:17:39Z","title":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a…","vendor":"Apache","product":"Shiro","tier":"tail","description":{"text":"Apache Shiro before 1.4.2, when using the default \"remember me\" configuration, cookies could be susceptible to a padding attack.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.09101,"percentile":0.95285,"provenance":"source"},"cwes":[],"references":[{"url":"https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":24.1,"factors":[{"name":"EPSS percentile","points":19.06},{"name":"Public exploit code","points":5.0}]},"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-11-08","earliestUrl":"https://github.com/BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC","repos":[{"name":"BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC","url":"https://github.com/BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC","stars":1,"created":"2024-11-08"}]},"first":{"date":"2024-11-08","source":"PoC-in-GitHub","url":"https://github.com/BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC"},"provenance":"source"},"vendorSlug":"apache","affectedVersions":[{"vendor":"Apache","product":"Shiro","versions":["to 1.4.1"]}],"affected":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","vulnerableRanges":["<1.4.2"],"patched":["1.4.2"],"from":["GHSA-r679-m633-g7wc"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0313","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-4437","published":"2016-06-07","fixed":"1.2.5","kev":true},{"cve":"CVE-2019-12422","published":"2019-11-18","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-1957","published":"2020-03-25","fixed":"1.5.2","kev":false,"link":{"from":"CVE-2019-12422","to":"CVE-2020-1957","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.shiro:shiro-core","fromFixed":"1.4.2","toFixed":"1.5.2","daysApart":128}]}},{"cve":"CVE-2020-11989","published":"2020-06-22","fixed":"1.5.3","kev":false},{"cve":"CVE-2020-13933","published":"2020-08-17","fixed":"1.6.0","kev":false}],"package":"Maven:org.apache.shiro:shiro-core"}}