Apache Aurora vulnerabilities

2 CVEs affecting Apache Aurora, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-27905, published 2024-02-27.

More from Apache.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-4437: Apache Shiro Code Execution Vulnerability, published 2016-06-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93% chance of exploitation in the next 30 days. Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an…
• CVE-2024-27905, published 2024-02-27. Critical severity, CVSS 9.1. EPSS: 1.5% chance of exploitation in the next 30 days. ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a…