Apereo CAS up to 5.3.15/6.1.7.1/6.2.3/6.3.0-RC3 Secret Key improper authentication

Summaryinfo

A vulnerability identified as problematic has been detected in Apereo CAS up to 5.3.15/6.1.7.1/6.2.3/6.3.0-RC3. This impacts an unknown function of the component Secret Key Handler. This manipulation causes improper authentication. This vulnerability is tracked as CVE-2020-27178. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Apereo CAS up to 5.3.15/6.1.7.1/6.2.3/6.3.0-RC3 and classified as problematic. Affected by this vulnerability is some unknown functionality of the component Secret Key Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality.

The weakness was disclosed 10/17/2020. It is possible to read the advisory at apereo.github.io. This vulnerability is known as CVE-2020-27178. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.3.16, 6.1.7.2, 6.2.4 or 6.3.0-RC4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Apereo

Name

• CAS

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 6.1.7.0
• 6.1.7.1
• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.3.0-RC3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion