« Volver al listado

CVE-2019-10754

Estado: ModificadaAlta (8.1)—

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apereo — Central Authentication Service

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-10754",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "report@snyk.io",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Apereo CAS",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to version 6.1.0-RC5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-09-23T23:15:10.640",
  "references": [
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "report@snyk.io"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869",
      "tags": [
        "Exploit",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong."
    },
    {
      "lang": "es",
      "value": "Múltiples clases utilizadas dentro de Apereo CAS versiones anteriores a 6.1.0-RC5, hacen uso de RandomStringUtils de Apache commons-lang3 para la generación de tokens e ID, lo que los hace predecibles debido a que el algoritmo de RandomStringUtils PRNG no es criptográficamente fuerte."
    }
  ],
  "lastModified": "2026-06-17T02:11:36.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C6A4035-A7B3-4400-B2ED-D4D9919B3706",
              "versionEndIncluding": "6.0.5.1"
            },
            {
              "criteria": "cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5B32255-0C1A-43BD-84B4-27AFDC107494"
            },
            {
              "criteria": "cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28107A51-D65B-4AB0-A6DC-D6B156F9EEC1"
            },
            {
              "criteria": "cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2D48F417-37C4-40DC-9483-DC57F6A2D164"
            },
            {
              "criteria": "cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4EAA0146-C82A-4E54-B738-BEBE354FF561"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "report@snyk.io"
}