CVE-2016-4437 PUBLISHED KEV

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

EPSS 94.25% · 99.9th percentile

Risk Scores

EPSS Score
94.25%
99.9th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTSshiro0, 1.2.4-1

Timeline

References

Open in Interactive Console →