Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-12422. PoCs published by BaiHLiu.
AI-analyzed exploit summary This repository provides a Dockerized environment for reproducing CVE-2019-12422, a Shiro deserialization vulnerability (Shiro-721) in RuoYi 4.2. It includes a pre-configured vulnerable application with JDK 1.8, Maven 3.1.1, and MySQL 5.7.
Description
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
Exploits (1)
nomisec
WORKING POC
1 stars
by BaiHLiu · poc
https://github.com/BaiHLiu/RuoYI-4.2-Shiro-721-Docker-PoC
This repository provides a Dockerized environment for reproducing CVE-2019-12422, a Shiro deserialization vulnerability (Shiro-721) in RuoYi 4.2. It includes a pre-configured vulnerable application with JDK 1.8, Maven 3.1.1, and MySQL 5.7.
Classification
Working Poc 90%
Attack Type
Deserialization
Complexity
Moderate
Reliability
Reliable
Target:
RuoYi 4.2 with Apache Shiro 1.4.1
No auth needed
Prerequisites:
Docker · Docker Compose · Git LFS for cloning
devstral-2 · analyzed Feb 18, 2026
Full analysis →
References (2)
Core 2
Core References
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/c9db14cfebfb8e74205884ed2bf2e2b30790ce24b7dde9191c82572c%40%3Cdev.shiro.apache.org%3E
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/r2d2612c034ab21a3a19d2132d47d3e4aa70105008dd58af62b653040%40%3Ccommits.shiro.apache.org%3E
Scores
CVSS v3
7.5
EPSS
0.5490
EPSS Percentile
98.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Lab Environment
Details
Status
published
Products (2)
apache/shiro
< 1.4.2
org.apache.shiro/shiro-core
0 - 1.4.2Maven
Published
Nov 18, 2019
Tracked Since
Feb 18, 2026