CVE-2016-4437—Apache Shiro Code Execution Vulnerability

PUBLISHEDvulnerability record

2021-11-03 · last modified June 21, 2025

Metadata

CVE ID:: CVE-2016-4437
Project:: Apache
Product:: Shiro
Date Added:: 2021-11-03
Due Date:: 2022-05-03
Last Updated:: June 21, 2025

Vulnerability Name

Apache Shiro Code Execution Vulnerability

Description

Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:: Unknown

Action

Apply updates per vendor instructions.

Additional Notes

Related Weaknesses

browse all CVEs