Severity
High
Analysis Summary
CVE-2016-4437
Apache Shiro could allow a remote attacker to execute arbitrary code on the system, caused by the use of a default cipher key for the “remember me” feature. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system or obtain sensitive information.
Impact
- Code Execution
Indicators Of Compromise
CVE
- CVE-2016-4437
Affected Vendors
Apache
Affected Products
Apache Shiro 1.0.0
Apache Shiro 1.1.0
Apache Shiro 1.2.0
Apache Shiro 1.2.1
Remediation
Upgrade to the latest version of Shiro, available from the Apache Web site.