CVE-2016-4437 – Apache Shiro Code Execution Vulnerability

https://notcve.org/view.php?id=CVE-2016-4437

03 Jun 2016 — Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. Apache Shiro en versiones anteriores a 1.2.5, cuando una clave de cifrado no ha sido configurada por la característica "remember me", permite a atacantes remotos ejecutar código arbitrario o eludir las restricciones destinadas al acceso a través de un parámetro request no especificado... • https://packetstorm.news/files/id/157497 • CWE-287: Improper Authentication CWE-321: Use of Hard-coded Cryptographic Key •