GHSA-g24w-373r-5pxgHighCVSS 8.1

Use of Insufficiently Random Values in Apereo CAS

Published
May 24, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2019-10754 →

📋 Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

🎯 Affected products6

  • maven/org.apereo.cas:cas-server-support-simple-mfa:< 6.1.0-RC5
  • maven/org.apereo.cas:cas-server-support-oidc:< 6.1.0-RC5
  • maven/org.apereo.cas:cas-server-core-services-api:< 6.1.0-RC5
  • maven/org.apereo.cas:cas-server-support-oauth-core-api:< 6.1.0-RC5
  • maven/org.apereo.cas:cas-server-support-shell:< 6.1.0-RC5
  • maven/org.apereo.cas:cas-server-core-services-authentication:< 6.1.0-RC5

🔗 References (8)