CVE-2019-10754

CVE-2019-10754 affects Apereo CAS before release 6.1.0-RC5. The root cause is the use of apache commons-lang3’s RandomStringUtils for token and ID generation, whose PRNG is not cryptographically strong, making generated values predictable. This predictability can enable an attacker to infer token...