GitHub Advisoryadvisory · Maven

GHSA-p836-389h-j692 Improper Access Control in Apache Shiro

CRITICAL Published 2022-05-14 Modified 2025-10-22 Official page ↗
Aliases
CVE-2016-4437
Ecosystem
Maven
Packages
org.apache.shiro:shiro-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-284, CWE-321
Reviewed
2022-07-06

Affected packages

• Maven org.apache.shiro:shiro-core: < 1.2.5 → fixed in 1.2.5

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Related

Alias · CVE (1)

  • CVE-2016-4437 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute… vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-321 Use of Hard-coded Cryptographic Key weakness

References