admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-06-20 01:40:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
GobyVuls/Shiro/CVE-2016-4437/README.md
tardc f9c130ae36 Add CVE-2016-4437
2020-05-25 19:53:00 +08:00

490 B
Raw Permalink Blame History

CVE-2016-4437 Apache Shiro Deserialization Vulnerability

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected Version: Apache Shiro < 1.2.5

FOFA query rule: app="Apache-Shiro"

Demo