Read the docs

Apereo

Records48All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical8CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9

Exploited now

Apereo records in CISA KEV

No Apereo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Opencast 20 records MEDIUM Central Authentication Service 13 records HIGH Phpcas 9 records MEDIUM .net Cas Client 1 record MEDIUM Bw-calendar-engine 1 record MEDIUM Bw-webdav 1 record LOW Cas Server 1 record MEDIUM Java Cas Client 1 record MEDIUM

Records

13 records in Central Authentication Service · all components

TI-2023-13363 CVE-2023-28857 · GHSA-p78h-m8pv-g9gm

LDAP password leak in Apereo CAS - GHSL-2023-009

Priority HIGH 66

Apereo CAS is an open source multilingual single sign-on solution for the web.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2023-06-27 Fixed in 6.5.9.1, 6.6.6 CWE-200
TI-2024-10382 CVE-2024-11208 · GHSA-cwh2-rj8j-gm58

Apereo CAS login session expiration

Priority MEDIUM 61

A vulnerability was found in Apereo CAS 6.6 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00751 Published 2024-11-14 No fix listed CWE-613
TI-2024-10383 CVE-2024-11209 · GHSA-w337-q6fh-r4gh

Apereo CAS 2FA login improper authentication

Priority MEDIUM 57

A vulnerability was found in Apereo CAS 6.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0062 Published 2024-11-14 No fix listed CWE-287
TI-2024-10381 CVE-2024-11207 · GHSA-f6hj-xq5g-h43f

Apereo CAS login redirect

Priority MEDIUM 57

A vulnerability has been found in Apereo CAS 6.6 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0038 Published 2024-11-14 No fix listed CWE-601
TI-2024-04097 CVE-2024-4399 · GHSA-q6fh-vc2v-h383

CAS <= 1.0.0 - Unauthenticated SSRF

Priority MEDIUM 51

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01821 Published 2024-05-23 No fix listed CWE-918
TI-2023-04254 CVE-2023-4612 · GHSA-fxgj-cfm7-w8hw

MFA bypass in Apereo CAS

Priority MEDIUM 44

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01115 Published 2023-11-09 No fix listed CWE-302
TI-2019-08019 CVE-2019-10754 · GHSA-g24w-373r-5pxg

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache…

Priority LOW 39

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01767 Published 2019-09-23 Fixed in 6.1.0-RC5 CWE-338
TI-2025-03528 CVE-2025-3985 · GHSA-8rx4-fxq5-vj4v

Apereo CAS ResponseEntity redos

Priority LOW 24

A vulnerability was found in Apereo CAS 5.2.6.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00634 Published 2025-04-27 No fix listed CWE-1333
Open these records in search →