Use of Insufficiently Random Values in Apereo CAS
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-10754US | high8.1OT erhöht | — | ||
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/apereo/casPACKAGE
- https://github.com/apereo/cas/commit/40bf278e66786544411c471de5123e7a71826b9fWEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-10754ADVISORY
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan