Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a Apereo CAS

  • All versions prior to version 6.1.0-RC5affected

References