CVE-2016-4437

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4437
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html Exploit Third Party Advisory VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-2035.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2036.html Third Party Advisory
http://www.securityfocus.com/archive/1/538570/100/0/threaded Broken Link Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/91024 Broken Link Third Party Advisory VDB Entry
https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
History

24 Jul 2024, 17:05

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html - () http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html - Third Party Advisory, VDB Entry
References () http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html - () http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References () http://rhn.redhat.com/errata/RHSA-2016-2035.html - () http://rhn.redhat.com/errata/RHSA-2016-2035.html - Third Party Advisory
References () http://rhn.redhat.com/errata/RHSA-2016-2036.html - () http://rhn.redhat.com/errata/RHSA-2016-2036.html - Third Party Advisory
References () http://www.securityfocus.com/archive/1/538570/100/0/threaded - () http://www.securityfocus.com/archive/1/538570/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securityfocus.com/bid/91024 - () http://www.securityfocus.com/bid/91024 - Broken Link, Third Party Advisory, VDB Entry
References () https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E - () https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E - Mailing List
CPE cpe:2.3:a:redhat:fuse:1.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:aurora:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_middleware_text-only_advisories:1.0:*:*:*:*:middleware:*:*
First Time Redhat jboss Middleware Text-only Advisories
Apache aurora
Redhat fuse
Redhat
CVSS v2 : 6.8
v3 : 8.1 		v2 : 6.8
v3 : 9.8
CWE CWE-284 NVD-CWE-noinfo

07 Nov 2023, 02:32

Type Values Removed Values Added
References
  • {'url': 'https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4@%3Cannouncements.aurora.apache.org%3E', 'name': '[announcements@aurora.apache.org] 20171101 Apache Aurora information disclosure vulnerability', 'tags': [], 'refsource': 'MLIST'}
  • () https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E -
Information

Published : 2016-06-07 14:06

Updated : 2024-07-24 17:05

NVD link : CVE-2016-4437

Mitre link : CVE-2016-4437

CVE.ORG link : CVE-2016-4437

JSON object : View

Products Affected

redhat

  • fuse
  • jboss_middleware_text-only_advisories

apache

  • aurora
  • shiro
CWE
NVD-CWE-noinfo