Skip to content
Heist/ feed
CriticalFix available

DEBIAN-CVE-2016-4437

Type: advisorySource: OSVKnown exploited1 source record

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2016-4437

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2016-4437

shiro

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
1.2.5-1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

shiro

Source reference: /affected/1/package/name

Affected versions
Not stated in this record
Fixed versions
1.2.5-1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

shiro

Source reference: /affected/2/package/name

Affected versions
Not stated in this record
Fixed versions
1.2.5-1

Source reference: /affected/2/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.2.5-1"
          }
        ]
      }
    ],
    "package": {
      "name": "shiro",
      "purl": "pkg:deb/debian/shiro?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2016-4437.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.2.5-1"
          }
        ]
      }
    ],
    "package": {
      "name": "shiro",
      "purl": "pkg:deb/debian/shiro?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2016-4437.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "1.2.5-1"
          }
        ]
      }
    ],
    "package": {
      "name": "shiro",
      "purl": "pkg:deb/debian/shiro?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2016-4437.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]
Related CVEs
CVE-2016-4437

Source reference: /upstream

Publisher severity

critical

Source reference: /severity/0/score

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2016-4437 · Unrated

Shiro · Known exploited (CISA KEV)

Event
#83575 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement