CVE-2016-4437
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Apache Shiro's 'remember me' feature has a critical flaw: when no encryption key is set, attackers can forge login tokens to bypass authentication or run malicious code on the server. This is dangerous because the feature is commonly used and the default configuration leaves systems vulnerable.
CVE-2016-4437 exploits improper cryptographic key management in Apache Shiro's RememberMe functionality (CWE-321). When no cipher key is configured, the serialized authentication token lacks encryption, allowing remote attackers to craft malicious serialized objects via request parameters that achieve arbitrary code execution through deserialization gadgets or direct authentication bypass. No authentication is required to trigger this vulnerability.
The full analysis of this CVE is available in Portuguese →