Improper Authentication in Apereo CAS

2021-08-0216:47:10

CWE-287

GitHub Advisory Database

github.com

0.001 Low

EPSS

Percentile

35.6%

JSON

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.

CPENameOperatorVersion
org.apereo.cas:cas-server-support-otp-mfa-corelt6.2.4
org.apereo.cas:cas-server-support-otp-mfa-corele6.1.7.1
org.apereo.cas:cas-server-support-otp-mfa-corelt5.3.16
org.apereo.cas:cas-server-webapplt6.2.4
org.apereo.cas:cas-server-webapple6.1.7.1
org.apereo.cas:cas-server-webapplt5.3.16

Name	Operator	Version
org.apereo.cas:cas-server-support-otp-mfa-core	lt	6.2.4
org.apereo.cas:cas-server-support-otp-mfa-core	le	6.1.7.1
org.apereo.cas:cas-server-support-otp-mfa-core	lt	5.3.16
org.apereo.cas:cas-server-webapp	lt	6.2.4
org.apereo.cas:cas-server-webapp	le	6.1.7.1
org.apereo.cas:cas-server-webapp	lt	5.3.16