{"action":"Upgrade org.apache.shiro:shiro-core to 1.2.5 or later.","affected":[{"fixed":"1.2.5","introduced":"0"}],"component":"org.apache.shiro:shiro-core","cve_ids":["CVE-2016-4437"],"ecosystem":"Maven","epss":0.93039,"exploited":true,"fixed_versions":["1.2.5"],"ghsa_id":"GHSA-p836-389h-j692","id":"tcs_01M5N96XBKV7S4K2TGD47PHGHZ","modified_at":"2025-10-22T19:25:56.524449Z","published_at":"2022-05-14T02:46:17Z","references":["https://osv.dev/vulnerability/GHSA-p836-389h-j692","https://nvd.nist.gov/vuln/detail/CVE-2016-4437","https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4%40%3Cannouncements.aurora.apache.org%3E","https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4@%3Cannouncements.aurora.apache.org%3E","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4437","http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html","http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html","http://rhn.redhat.com/errata/RHSA-2016-2035.html","http://rhn.redhat.com/errata/RHSA-2016-2036.html","http://www.securityfocus.com/archive/1/538570/100/0/threaded","http://www.securityfocus.com/bid/91024"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-p836-389h-j692","url":"https://osv.dev/vulnerability/GHSA-p836-389h-j692"},{"source":"kev","source_id":"CVE-2016-4437","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}],"summary":"Improper Access Control in Apache Shiro"}