CVE-2016-4437 High Severity Vulnerability detected by WhiteSource

[mend-bolt-for-github]

CVE-2016-4437 - High Severity Vulnerability

Vulnerable Library - shiro-core-1.2.0.jar

Apache Shiro is a powerful and flexible open-source security framework that cleanly handles authentication, authorization, enterprise session management, single sign-on and cryptography services.

path: /root/.m2/repository/org/apache/shiro/shiro-core/1.2.0/shiro-core-1.2.0.jar,2/repository/org/apache/shiro/shiro-core/1.2.0/shiro-core-1.2.0.jar

Library home page: http://shiro.apache.org/shiro-core/

Dependency Hierarchy:

• shiro-web-1.2.0.jar (Root Library)
  • ❌ shiro-core-1.2.0.jar (Vulnerable Library)

Found in HEAD commit: 23068bfa8fba8e934988efafc64fa2cf0fdb8462

Vulnerability Details

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Publish Date: 2016-06-07

URL: CVE-2016-4437

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-4437

Fix Resolution: Upgrade to version shiro 1.2.5 or greater

---

Step up your Open Source Security Game with WhiteSource here