Lucene search

GitHub Advisory DatabaseGHSA-Q39C-5VH5-VW2P

HistoryAug 02, 2021 - 4:47 p.m.

Improper Authentication in Apereo CAS

2021-08-0216:47:10

CWE-287

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.9%

JSON

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.

Affected configurations

Vulners

Node

github_advisory_databaseorg.apereo.cas\Matchcas-server-support-otp-mfa-core

github_advisory_databaseorg.apereo.cas\Matchcas-server-webapp

CPENameOperatorVersion
org.apereo.cas:cas-server-support-otp-mfa-corelt6.2.4
org.apereo.cas:cas-server-support-otp-mfa-corele6.1.7.1
org.apereo.cas:cas-server-support-otp-mfa-corelt5.3.16
org.apereo.cas:cas-server-webapplt6.2.4
org.apereo.cas:cas-server-webapple6.1.7.1
org.apereo.cas:cas-server-webapplt5.3.16

Name	Operator	Version
org.apereo.cas:cas-server-support-otp-mfa-core	lt	6.2.4
org.apereo.cas:cas-server-support-otp-mfa-core	le	6.1.7.1
org.apereo.cas:cas-server-support-otp-mfa-core	lt	5.3.16
org.apereo.cas:cas-server-webapp	lt	6.2.4
org.apereo.cas:cas-server-webapp	le	6.1.7.1
org.apereo.cas:cas-server-webapp	lt	5.3.16

References

apereo.github.io/2020/10/14/gauthvuln/

github.com/advisories/GHSA-q39c-5vh5-vw2p

nvd.nist.gov/vuln/detail/CVE-2020-27178

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

35.9%

JSON

Related for GHSA-Q39C-5VH5-VW2P