{"id":"CVE-2016-4437","aliases":["DEBIAN-CVE-2016-4437","EUVD-2022-4711","GHSA-p836-389h-j692","UBUNTU-CVE-2016-4437","USN-7139-1"],"status":"published","title":"Improper Access Control in Apache Shiro","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.93039,"percentile":0.99833,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-284","CWE-321"],"published":"2016-06-07T14:00:00Z","modified":"2026-11-03T02:45:17Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/shiro_rememberme_v124_deserialize","title":"Apache Shiro v1.2.4 Cookie RememberME Deserial RCE","type":"exploit","platform":"Unix,Windows","date":"2016-06-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/shiro_rememberme_v124_deserialize"},{"source":"exploitdb","id":"EDB-48410","title":"Apache Shiro 1.2.4 - Cookie RememberME Deserial RCE (Metasploit)","type":"remote","platform":"multiple","date":"2020-05-01","verified":true,"url":"https://www.exploit-db.com/exploits/48410"},{"source":"pocgithub","id":"bkfish/Awesome_shiro","title":"bkfish/Awesome_shiro","date":"2020-05-27","url":"https://github.com/bkfish/Awesome_shiro"},{"source":"pocgithub","id":"m3terpreter/CVE-2016-4437","title":"m3terpreter/CVE-2016-4437","date":"2021-06-22","url":"https://github.com/m3terpreter/CVE-2016-4437"},{"source":"pocgithub","id":"4nth0ny1130/shisoserial","title":"4nth0ny1130/shisoserial","date":"2021-12-23","url":"https://github.com/4nth0ny1130/shisoserial"},{"source":"pocgithub","id":"pizza-power/CVE-2016-4437","title":"pizza-power/CVE-2016-4437","date":"2023-12-22","url":"https://github.com/pizza-power/CVE-2016-4437"},{"source":"pocgithub","id":"xk-mt/CVE-2016-4437","title":"xk-mt/CVE-2016-4437","date":"2024-01-15","url":"https://github.com/xk-mt/CVE-2016-4437"},{"source":"pocgithub","id":"35789-gh/cve-2016-4437","title":"35789-gh/cve-2016-4437","date":"2026-02-19","url":"https://github.com/35789-gh/cve-2016-4437"},{"source":"pocgithub","id":"CyberCTF/vulhub-shiro-cve-2016-4437","title":"CyberCTF/vulhub-shiro-cve-2016-4437","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-shiro-cve-2016-4437"},{"source":"nuclei","id":"CVE-2016-4437","title":"Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4437.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.shiro:shiro-core","fixed_in":["1.2.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"shiro","fixed_in":["1.2.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"shiro","fixed_in":["1.2.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"shiro","fixed_in":["1.2.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"shiro","fixed_in":["1.2.4-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.4"},{"fixed":"1.2.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.shiro:shiro-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5"}]}],"versions":["1.0.0-incubating","1.1.0","1.2.0","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1~esm1"}]}],"versions":["1.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"shiro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1ubuntu0.1~esm1"}]}],"versions":["1.2.4-1"]}],"products":[{"vendor":"apache","product":"aurora"},{"vendor":"apache","product":"shiro"},{"vendor":"redhat","product":"fuse"},{"vendor":"redhat","product":"jboss_middleware_text-only_advisories"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2035.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article","web"]},{"url":"http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2036.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/91024","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/538570/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4437","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4@%3Cannouncements.aurora.apache.org%3E","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p836-389h-j692"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4437","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-4437","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4437","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7139-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2025-10-21T23:55:51.717Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2022-4711","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:00:00Z","modified":"2025-10-21T23:55:51Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T19:49:39.684828Z"}],"ghsa":[{"id":"GHSA-p836-389h-j692","title":"Improper Access Control in Apache Shiro","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2022-05-14T02:46:17Z","modified":"2025-10-22T17:34:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-284","CWE-321"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2016-4437","title":"Apache Shiro Code Execution Vulnerability","description":"Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.","cwes":["CWE-284"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:06:13.247Z","modified":"2026-06-17T00:47:33.31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-321"],"updated_at":"2026-11-02T14:03:26.642445Z"}],"osv":[{"id":"CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:06:13.247Z","modified":"2026-11-03T02:45:17.276112665Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:05:43.703218Z"},{"id":"DEBIAN-CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:06:13.247Z","modified":"2026-10-05T04:00:03.032310509Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-p836-389h-j692","title":"Improper Access Control in Apache Shiro","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2022-05-14T02:46:17Z","modified":"2025-10-22T19:25:56.524449Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","level":"critical"}],"cwes":["CWE-284","CWE-321"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2016-4437","description":"Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.","status":"published","published":"2016-06-07T14:06:00Z","modified":"2026-02-04T03:30:25.724611Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"USN-7139-1","title":"shiro vulnerability","description":"It was discovered that Apache Shiro used a static cipher within the\n\"Remember Me\" feature inside authentication by default. An attacker could\npossibly use this issue to achieve remote code execution or obtain\nsensitive information.\n","status":"published","published":"2024-12-05T14:07:51Z","modified":"2026-06-25T13:32:29.854879322Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}