Use of Insufficiently Random Values in Apereo CAS
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-10754US | high8.1OT elevated | — | ||
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/apereo/casPACKAGE
- https://github.com/apereo/cas/commit/40bf278e66786544411c471de5123e7a71826b9fWEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10754ADVISORY
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan