CVE-2018-13257

The CVE-2018-13257 vulnerability affects Blackboard Learn (2018-07-02) in the bb-auth-provider-cas authentication module. The issue is HTTP host header spoofing during CAS service ticket validation, enabling a phishing attack from the CAS server login page. Connected records consistently describe...

CVE-2018-13257: URL Redirection to Untrusted Site

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service CAS service ticket validation, enabling a phishing attack from the CAS server login page...

PT-2019-8928

Name of the Vulnerable Software and Affected Versions Blackboard Learn version 2018-07-02 Description The issue concerns HTTP host header spoofing during Central Authentication Service CAS service ticket validation in the bb-auth-provider-cas authentication module. This allows for a phishing atta...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.3.1, <=5.3.3) +232 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (>=3.0.0-rc2, <=3.1.0)

org.pac4j:pac4j-saml MAVEN version =3.0.0-rc2, =5.3.1, =5.3.1, =5.3.1, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.0-rc4, =5.3.3 and more Source cves: CVE-2019-10755 Source advisory: GHSA-RC75-CF5C-MXVH...

org.apereo.cas:cas-management-webapp-support (5.1.0-rc4), org.apereo.cas:cas-management-webapp-support-ldap (5.1.0-rc4) +122 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (2.0.0-rc2)

org.pac4j:pac4j-saml MAVEN version 2.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.apereo.cas:cas-management-webapp-support 5.1.0-rc4 - org.apereo.cas:cas-management-webapp-support-ldap 5.1.0-rc...

org.apache.knox:gateway-provider-security-pac4j (>=0.14.0, <=1.1.0), org.apache.knox:gateway-release (>=0.14.0, <=1.1.0) +205 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (2.1.0)

org.pac4j:pac4j-saml MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.apache.knox:gateway-provider-security-pac4j =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =5.2.0-rc2,...

org.apereo.cas:cas-management-webapp (>=5.0.6, <=5.0.10), org.apereo.cas:cas-management-webapp-support (>=5.0.6, <=5.0.10) +84 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.9.7)

org.pac4j:pac4j-saml MAVEN version 1.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.apereo.cas:cas-management-webapp =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6, =5.0.6,...

org.jasig.cas:cas-server-support-pac4j (>=4.2.0-rc1, <=4.2.1), org.jasig.cas:cas-server-support-pac4j-webflow (>=4.2.0-rc1, <=4.2.1) +1 more potentially affected by CVE-2019-10755 via org.pac4j:pac4j-saml (1.8.2)

org.pac4j:pac4j-saml MAVEN version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-saml and may be impacted: - org.jasig.cas:cas-server-support-pac4j =4.2.0-rc1, =4.2.0-rc1, =4.2.1 - org.pac4j:pac4j-config 1.8.2 Source cves:...

org.apereo.cas:cas-management-webapp-support (5.2.0-rc1), org.apereo.cas:cas-management-webapp-support-ldap (5.2.0-rc1) +132 more potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (4.39.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apereo.cas:cas-management-webapp-support 5.2.0-rc1 -...

org.apereo.cas:cas-management-webapp (5.0.0.rc1), org.apereo.cas:cas-management-webapp-support (5.0.0.rc1) +81 more potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (4.26)

com.nimbusds:nimbus-jose-jwt MAVEN version 4.26 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apereo.cas:cas-management-webapp 5.0.0.rc1 - org.apereo.cas:cas-management-webapp-support 5.0.0.rc1 ...

be.atbash.ee.security:octopus-cas (0.6), be.atbash.ee.security:octopus-cas-se (0.6) +55 more potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (6.3)

com.nimbusds:nimbus-jose-jwt MAVEN version 6.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - be.atbash.ee.security:octopus-cas 0.6 - be.atbash.ee.security:octopus-cas-se 0.6 -...

org.apereo.cas:cas-mgmt-api-configuration (6.0.0-rc4), org.apereo.cas:cas-mgmt-core-util (6.0.0-rc4) +270 more potentially affected by CVE-2019-17195 via com.nimbusds:nimbus-jose-jwt (6.4.1)

com.nimbusds:nimbus-jose-jwt MAVEN version 6.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.nimbusds:nimbus-jose-jwt and may be impacted: - org.apereo.cas:cas-mgmt-api-configuration 6.0.0-rc4 - org.apereo.cas:cas-mgmt-core-util 6.0.0-rc4 -...

Insecure Random Number Generation

Apereo Cas is vulnerable to insecure random number generation. Multiple classes relies on weak random numbers generated from org.apache.commons.lang3.RandomStringUtils class, allowing an attacker to easily predict the random number and perform brute force attack...

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

Code injection

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

CVE-2019-10754

CVE-2019-10754 affects Apereo CAS before release 6.1.0-RC5. The root cause is the use of apache commons-lang3’s RandomStringUtils for token and ID generation, whose PRNG is not cryptographically strong, making generated values predictable. This predictability can enable an attacker to infer token...

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...

org.apereo.cas:cas-management-webapp-configuration (>=5.3.1, <=5.3.3), org.apereo.cas:cas-management-webapp-support (>=5.2.0-rc2, <=5.3.3) +271 more potentially affected by CVE-2019-10754 via org.apereo.cas:cas-server-core-services-api (>=v6.4.0-rc5, <=6.1.0-rc4)

org.apereo.cas:cas-server-core-services-api MAVEN version =v6.4.0-rc5, =5.3.1, =5.2.0-rc2, =5.3.1, =6.1.0-rc2, =6.0.0-rc4, =6.0.0-rc4, =v6.4.0-rc5, =v6.4.0-rc5, =v6.4.0-rc5, =v6.4.0-rc5, =5.2.0-rc2, =v6.4.0-rc5, =v6.4.0-rc5, =5.3.0-rc2, =v6.4.0-rc5, =6.1.0-rc4 and more Source cves: CVE-2019-10754...

CVE-2019-10754

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong...