CVE-2016-4437

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 GitHub

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

93.04% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2021-11-03

Nuclei

high · CWE-284

Published

2016-06-07

Updated

2025-10-21

Proof-of-concept exploits (8)

• http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
• Pensa31/Hacker0★ · 2025-06-19
• jas502n/Shiro_Xray58★ · 2020-11-16
• pizza-power/CVE-2016-44372★ · 2024-06-29
• xk-mt/CVE-2016-44370★ · 2024-01-16
• N0tOd2y/PenForge1★ · 2026-09-05
• xunjinghan/bounty-forge3★ · 2026-10-16
• xunwmw/vuln-xiuxian3★ · 2026-10-16

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2016/CVE-2016-4437.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shiro_rememberme_v124…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/48410

Vulhub environments (1)

• vulhub/vulhub/tree/master/shiro/CVE-2016-4437

Security advisories

• http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
• http://rhn.redhat.com/errata/RHSA-2016-2035.html
• http://rhn.redhat.com/errata/RHSA-2016-2036.html
• http://www.securityfocus.com/archive/1/538570/100/0/threaded
• http://www.securityfocus.com/bid/91024
• advisories/GHSA-p836-389h-j692

References

• CVE Record
• NVD entry

Related

• CVE-2017-10271
• CVE-2019-2729
• CVE-2021-22204
• CVE-2021-22205
• CVE-2021-44077
• CVE-2022-0824