Description
Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management.
Apache Shiro is using a default rememberme cookie that is encrypted with a hardcoded encryption key. An attacker can create a malicious object, serialize it, encode it, then send it as a cookie. Shiro will then decode and deserialize it.
Remediation
Upgrade to the latest version of Apache Shiro.
References
Related Vulnerabilities
WordPress Plugin Master Popups Remote Code Execution (1.0.0)
Apache Struts Path traversal (S2-067/CVE-2024-53677, S2-066/CVE-2023-50164)
WordPress Plugin WooCommerce Possible Remote Code Execution (3.5.0)
Remote code execution in bootstrap-sass 3.2.0.3
WordPress Plugin Form Manager Remote Command Execution (1.7.2)