CVE-2019-10754 in CAS

Résumé

par MITRE

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Réserver: 03/04/2019
• Modérer: accepté
• Entrée: VDB-142145
• CPE: prêt
• CWE: CWE-338 (confirmé)
• CVSS: 8.1 (NVD)
• EPSS: 0.01751
• KEV: non
• Activités: très faible

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2019-10754
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2019-10754
• CVE Details: https://www.cvedetails.com/cve/CVE-2019-10754/