9.8Kritik
KEV
CVE-2016-4437Apache Shiro Code Execution Vulnerability
Aktif olarak istismar ediliyor — Apache Shiro Code Execution Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 03.11.2021 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 03.05.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-4437
Açıklama
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Zayıflık türü (CWE):
CWE-321
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- RHSA-2016:2035 vendor-advisoryThird Party Advisory
- [announcements@aurora.apache.org] 20171101 Apache Aurora information disclosure vulnerability mailing-listMailing List
- http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html Third Party AdvisoryVDB Entry
- RHSA-2016:2036 vendor-advisoryThird Party Advisory
- 91024 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 20160603 [Announce] CVE-2016-4437: Apache Shiro information disclosure vulnerability mailing-listBroken LinkThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437 US Government Resource
CPE eşleşmeleri (NVD) (4)
cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*≥ 0.10.0 < 0.18.1cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*< 1.2.5cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*