CVE-2019-10754
EUVD-2022-385923.09.2019, 23:15
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| apereo | central_authentication_service | 𝑥 ≤ 6.0.5.1 |
| apereo | central_authentication_service | 6.1.0:rc1 |
| apereo | central_authentication_service | 6.1.0:rc2 |
| apereo | central_authentication_service | 6.1.0:rc3 |
| apereo | central_authentication_service | 6.1.0:rc4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References