- Vendor / Project
- Apache
- Product
- Shiro
- Date added
- Nov 3, 2021
- Due date
- May 3, 2022
- Known ransomware use
- Unknown
- CWEs
- CWE-284
Description
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
Required action
Apply updates per vendor instructions.