Use of Insufficiently Random Values in Apereo CAS

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

org.apereo.cas:cas-server-core (5.2.6), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.6) +132 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.2.6)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.2.6 -...

org.apereo.cas:cas-server-core (5.2.2), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.2) +128 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.2.2)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-server-core 5.2.2 -...

org.apereo.cas:cas-server-core (5.2.0-rc4), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.0-rc4) +126 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.2.0-rc4)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.2.0-rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-server-core 5.2.0-rc4 -...

org.apereo.cas:cas-server-core (5.3.0), org.apereo.cas:cas-server-core-logout (5.3.0) +155 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.3.0)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.3.0 -...

org.apereo.cas:cas-server-core (5.2.5), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.5) +132 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.2.5)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.2.5 -...

org.apereo.cas:cas-management-webapp-support (5.3.0-rc3) potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.3.0-rc3)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.3.0-rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-management-webapp-support 5.3.0-rc3 Source cves:...

org.apereo.cas:cas-management-webapp-configuration (5.3.1), org.apereo.cas:cas-management-webapp-support (5.3.1) +155 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.3.1)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-management-webapp-configuration...

org.apereo.cas:cas-server-core (5.2.6), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.6) +128 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.2.6)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-server-core 5.2.6 -...

org.apereo.cas:cas-server-core (5.2.2), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.2) +132 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.2.2)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.2.2 -...

org.apereo.cas:cas-server-core (5.2.7), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.7) +132 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (5.2.7)

org.apereo.cas:cas-server-core-services-api MAVEN version 5.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-api and may be impacted: - org.apereo.cas:cas-server-core 5.2.7 -...

org.apereo.cas:cas-mgmt-api-configuration (>=6.1.0-rc2, <=6.1.0-rc4), org.apereo.cas:cas-mgmt-core-util (>=6.0.0-rc4, <=6.1.0-rc4) +185 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (>=6.0.0-rc4, <=6.1.0-rc4)

org.apereo.cas:cas-server-core-services-authentication MAVEN version =6.0.0-rc4, =6.1.0-rc2, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.0.0-rc4, =6.1.0-rc4 and more Source cves:...

org.apereo.cas:cas-server-core (5.2.0), org.apereo.cas:cas-server-core-configuration-cloud-mongo (5.2.0) +128 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.2.0)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-server-core 5.2.0 -...

org.apereo.cas:cas-management-webapp-support (5.3.0-rc1), org.apereo.cas:cas-server-core (5.3.0-rc1) +136 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.3.0-rc1)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.3.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-management-webapp-support...

org.apereo.cas:cas-server-core (5.3.0), org.apereo.cas:cas-server-core-logout (5.3.0) +152 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-authentication (5.3.0)

org.apereo.cas:cas-server-core-services-authentication MAVEN version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-services-authentication and may be impacted: - org.apereo.cas:cas-server-core 5.3.0 -...

com.sdl.delivery:udp-service-container-core (>=11.0.0-1078, <=11.0.1-1016), org.springframework.security:spring-security-cas (4.2.16.release) +3 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.16.release)

org.springframework.security:spring-security-web MAVEN version 4.2.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.sdl.delivery:udp-service-container-core...

org.apache.syncope:syncope-core (>=1.0.9, <=1.1.8), org.springframework.security:spring-security-cas (3.1.6.release) +5 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.1.6.release)

org.springframework.security:spring-security-web MAVEN version 3.1.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.apache.syncope:syncope-core =1.0.9, =1.4.9, =1.4.9,...

org.springframework.security:spring-security-cas (3.1.5.release), org.springframework.security:spring-security-openid (3.1.5.release) +1 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.1.5.release)

org.springframework.security:spring-security-web MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.springframework.security:spring-security-cas...

org.springframework.security:spring-security-acl (3.1.5.release), org.springframework.security:spring-security-aspects (3.1.5.release) +7 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (3.1.5.release)

org.springframework.security:spring-security-core MAVEN version 3.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - org.springframework.security:spring-security-acl...

org.jasig.cas:cas-server-webapp (>=3.4-rc1, <=3.4.3), org.springframework.security:spring-security-cas-client (3.0.1.release) +8 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (3.0.1.release)

org.springframework.security:spring-security-web MAVEN version 3.0.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - org.jasig.cas:cas-server-webapp =3.4-rc1, =3.4.3 -...