Apache · Shiro
The flaw is in Apache Shiro, the Java security framework, and affects versions before 1.2.5 when the "remember me" feature is used without a configured cipher key. An attacker with network access can send a request containing an unspecified parameter to execute arbitrary code or bypass intended access restrictions, requiring no authentication or user interaction and only the vulnerable configuration.
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
First seen exploited 5 years after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-2016-4437 is a code execution vulnerability in Apache Shiro that allows remote attackers to execute code or bypass access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: org.apache.shiro:shiro-core.
Upgrade to 1.8.0 or later
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-1957, CVE-2021-41303).
Set the version to 1.8.0 or later in your pom.xml or build.gradle.
First fixed in 1.2.5 for CVE-2016-4437.
| If you run | Upgrade to |
|---|---|
| All versions before 1.2.5 | 1.8.0first fix for this CVE: 1.2.5 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.