{"id":"CVE-2016-4437","kind":"vulnerability","aliases":["CVE-2016-4437"],"related":[],"title":"Apache Shiro: Apache Shiro Code Execution Vulnerability","description":"Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the \"remember me\" feature.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Apache Shiro, a Java security and access-control library, has a flaw where a crafted request parameter can run code or bypass access checks when the \"remember me\" feature has no cipher key configured. Attackers can gain code execution on the server without logging in.","severity":"critical","cvss":9.8,"epss":0.93039,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Apache Shiro","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-shiro","exploited","java","package","spring"],"not_affected_if":["cipher-key-configured","remember-me-disabled"],"how_to_check":"Search application config and code for the \"remember me\" setting (rememberMeManager / cipherKey) and confirm a cipher key is set; check the Shiro version in dependencies (pom.xml, build.gradle, or lockfile).","fix":"Upgrade Apache Shiro to a fixed release per the vendor advisory (fixed version unknown from sources), and set an explicit, strong rememberMe cipher key.","status":"open","published_at":"2016-06-07T14:06:13+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:37:05+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:37:05Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Shiro to a fixed release per the vendor advisory (fixed version unknown from sources), and set an explicit, strong rememberMe cipher key.\nunknown","reach":"internet","impact":"high","summary":"Apache Shiro, a Java security and access-control library, has a flaw where a crafted request parameter can run code or bypass access checks when the \"remember me\" feature has no cipher key configured. Attackers can gain code execution on the server without logging in.","category":"package","who_cares":["java","apache-shiro","spring"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker runs code on the server and bypasses access restrictions","analyst_note":"Find the fixed Shiro version and the exact remember-me condition in the Apache Shiro advisory for CVE-2016-4437 (shiro.apache.org security page).","how_to_check":"Search application config and code for the \"remember me\" setting (rememberMeManager / cipherKey) and confirm a cipher key is set; check the Shiro version in dependencies (pom.xml, build.gradle, or lockfile).\nunknown\nunknown","needs_analyst":true,"not_affected_if":["remember-me-disabled","cipher-key-configured"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000519,"input_tokens":2842,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2016':9A,12A '-4437':10A,13A 'access':30B,46B,84C 'access-control':29B 'action':106C 'allow':75C 'apach':1A,3A,17B,23B,68C 'apache':14A 'apache-shiro':16B 'appli':107C 'attack':58B,77C 'bypass':45B,82C 'check':47B 'cipher':55B,93C 'cisa':104C 'code':5A,43B,61B,80C 'configur':57B,98C 'contain':70C 'control':31B 'craft':38B 'cve':8A,11A 'execut':6A,62B,79C 'exploit':19B 'featur':52B,103C 'flaw':35B 'gain':60B 'instruct':111C 'intend':83C 'java':20B,26B 'key':56B,94C 'librari':32B 'log':67B 'may':74C 'packag':21B 'paramet':40B,90C 'per':109C 'rememb':50B,101C 'remot':76C 'request':39B,89C 'requir':105C 'restrict':85C 'run':42B 'secur':27B 'server':65B 'shiro':2A,4A,15A,18B,24B,69C 'spring':22B 'unspecifi':88C 'updat':108C 'vendor':110C 'via':86C 'vulner':7A,72C 'without':66B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2016-06-07T14:06:13+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2016-4437","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-4437","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2016-4437","url":"https://api.first.org/data/v1/epss?cve=CVE-2016-4437","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2016-4437","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4437","severity":null,"published_at":"2016-06-07T14:06:13+00:00","modified_at":"2026-06-17T00:47:33+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}