| शीर्षक | Apereo CAS v5.2.6 ReDos regular expression engine denial of service |
|---|
| विवरण | 1.Vulnerability Name:
Apereo CAS application has a ReDos regular expression engine denial of service vulnerability.
2.Vulnerability level : Medium.
3.Vulnerability discoverer and contributor:蔡超雄 (caichaoxiong)
4.Vulnerability Description
The query parameters of the Apereo CAS v5.2.6 management console (cas-management) are controllable, and malicious attackers can use carefully constructed regular expressions to exhaust server resources .
5.Vulnerability Risk
Sending a large number of requests with malicious regular expressions will cause all threads in the thread pool to execute regular expression matching, consuming a large amount of CPU resources, making it impossible to respond to normal requests, resulting in a denial of service attack. |
|---|
| स्रोत | ⚠️ https://wx.mail.qq.com/s?k=lzDuxVkSRXUZ0bwZEG |
|---|
| उपयोगकर्ता | caichaoxiong (UID 84060) |
|---|
| सबमिशन | 12/04/2025 04:19 PM (1 वर्ष पहले) |
|---|
| संयम | 26/04/2025 10:07 AM (14 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 306321 [Apereo CAS 5.2.6 ResponseEntity प्रश्न सेवा अस्वीकार] |
|---|
| अंक | 17 |
|---|