Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Central_authentication_service
(Apereo)| Repositories | https://github.com/Jasig/cas |
| #Vulnerabilities | 6 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-11-09 | CVE-2023-4612 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability. | Central_authentication_service | 9.8 | ||
| 2023-06-27 | CVE-2023-28857 | Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points”... | Central_authentication_service | 7.5 | ||
| 2021-12-07 | CVE-2021-42567 | Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. | Central_authentication_service | 6.1 | ||
| 2020-10-16 | CVE-2020-27178 | Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication. | Central_authentication_service | 7.5 | ||
| 2019-09-23 | CVE-2019-10754 | Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. | Central_authentication_service | N/A | ||
| 2015-02-10 | CVE-2015-1169 | Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication. | Central_authentication_service | N/A |