Skip to content
OpenAdvisories
Critical 1 exploited CVE USN-7139-1 1 CVE

shiro vulnerability

Published Dec 5, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Apache Shiro used a static cipher within the
"Remember Me" feature inside authentication by default. An attacker could
possibly use this issue to achieve remote code execution or obtain
sensitive information.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS shiro 1.2.4-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021

References

  • report
    https://ubuntu.com/security/CVE-2016-4437