CVE-2019-10754: apereo central_authentication_service

Vulnerability summary

CVE-2019-10754 is a high (CVSS 8.1) vulnerability in apereo central_authentication_service. EPSS estimates a 1.77% chance of exploitation in the next 30 days, higher than 77.7% of scored vulnerabilities. 5 public exploits are recorded.

Timeline

1. 23-09-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

• CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.