CVE-2019-12422 — shiro: Cookie padding oracle vulnerability with default configuration

HIGH

shiro: Cookie padding oracle vulnerability with default configuration

Published Nov 18, 2019

7.5

HIGH

CVSS 3.1

EPSS 9.10%

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
to 1.4.1	affected	-

Product	Package	State	Advisory
Red Hat Fuse 7.6.0	shiro-core	Fixed	RHSA-2020:0983
Red Hat JBoss A-MQ 6	shiro-core	Out of support scope	n/a
Red Hat JBoss Fuse 6	shiro-core	Out of support scope	n/a
Red Hat JBoss Fuse Service Works 6	shiro-core	Out of support scope	n/a
Red Hat OpenStack Platform 10 (Newton)	opendaylight	Out of support scope	n/a
Red Hat OpenStack Platform 13 (Queens)	opendaylight	Will not fix	n/a
Red Hat OpenStack Platform 14 (Rocky)	opendaylight	Will not fix	n/a

No remediation recorded yet.

9.10% 0.09101

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.09101

2021–2026

Table of values (27 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	9.10% (0.09101)	95.16th	v5 (v2026.06.15)
Jun 15, 2026	9.10% (0.09101)	94.63th	v5 (v2026.06.15)
Mar 15, 2026	54.90% (0.54895)	98.01th	v4 (v2025.03.14)
Nov 21, 2025	56.42% (0.56421)	97.99th	v4 (v2025.03.14)
Nov 18, 2025	51.84% (0.51836)	97.78th	v4 (v2025.03.14)
Oct 30, 2025	56.42% (0.56421)	97.98th	v4 (v2025.03.14)
Sep 14, 2025	60.86% (0.60861)	98.25th	v4 (v2025.03.14)
Mar 30, 2025	66.03% (0.66035)	98.38th	v4 (v2025.03.14)
Mar 29, 2025	82.82% (0.82824)	99.05th	v4 (v2025.03.14)
Mar 28, 2025	66.03% (0.66035)	98.38th	v4 (v2025.03.14)
Mar 27, 2025	74.46% (0.74464)	98.74th	v4 (v2025.03.14)
Mar 24, 2025	66.03% (0.66035)	98.41th	v4 (v2025.03.14)
Mar 23, 2025	74.46% (0.74464)	98.76th	v4 (v2025.03.14)
Mar 20, 2025	66.03% (0.66035)	98.42th	v4 (v2025.03.14)
Mar 19, 2025	74.46% (0.74464)	98.76th	v4 (v2025.03.14)
Mar 17, 2025	63.27% (0.63273)	98.24th	v4 (v2025.03.14)
Dec 12, 2024	0.22% (0.00220)	60.93th	v3 (v2023.03.01)
Jul 8, 2023	0.19% (0.00195)	56.23th	v3 (v2023.03.01)
Mar 7, 2023	0.21% (0.00211)	57.17th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Sep 10, 2022	0.89% (0.00885)	26.24th	v2 (v2022.01.01)
Apr 1, 2022	0.89% (0.00885)	24.24th	v2 (v2022.01.01)
Feb 4, 2022	4.50% (0.04499)	74.08th	v2 (v2022.01.01)
Feb 3, 2022	7.82% (0.07819)	84.70th	v1
Jan 6, 2022	7.82% (0.07819)	84.53th	v1
Sep 1, 2021	1.85% (0.01855)	75.73th	v1
Apr 14, 2021	1.85% (0.01855)	0.00th	v1

Weaknesses (1)

CWE-20

Improper Input Validation

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2019-12422		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1774726		Issue Tracking
https://github.com/advisories/GHSA-r679-m633-g7wc		Advisory
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c@%3Cdev.shiro.apache.org%3E
https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040@%3Ccommits.shiro.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2019-12422
https://www.cve.org/CVERecord?id=CVE-2019-12422