Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: Apereo Component: Central Authentication Service Clear all filters
TI-2025-03528 CVE-2025-3985 · GHSA-8rx4-fxq5-vj4v

Apereo CAS ResponseEntity redos

Priority LOW 24

A vulnerability was found in Apereo CAS 5.2.6.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00634 Published 2025-04-27 No fix listed CWE-1333
TI-2024-10383 CVE-2024-11209 · GHSA-w337-q6fh-r4gh

Apereo CAS 2FA login improper authentication

Priority MEDIUM 57

A vulnerability was found in Apereo CAS 6.6.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0062 Published 2024-11-14 No fix listed CWE-287
TI-2024-10382 CVE-2024-11208 · GHSA-cwh2-rj8j-gm58

Apereo CAS login session expiration

Priority MEDIUM 61

A vulnerability was found in Apereo CAS 6.6 and classified as problematic.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00751 Published 2024-11-14 No fix listed CWE-613
TI-2024-10381 CVE-2024-11207 · GHSA-f6hj-xq5g-h43f

Apereo CAS login redirect

Priority MEDIUM 57

A vulnerability has been found in Apereo CAS 6.6 and classified as problematic.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0038 Published 2024-11-14 No fix listed CWE-601
TI-2024-04097 CVE-2024-4399 · GHSA-q6fh-vc2v-h383

CAS <= 1.0.0 - Unauthenticated SSRF

Priority MEDIUM 51

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF attack

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01821 Published 2024-05-23 No fix listed CWE-918
TI-2023-04254 CVE-2023-4612 · GHSA-fxgj-cfm7-w8hw

MFA bypass in Apereo CAS

Priority MEDIUM 44

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01115 Published 2023-11-09 No fix listed CWE-302
TI-2023-13363 CVE-2023-28857 · GHSA-p78h-m8pv-g9gm

LDAP password leak in Apereo CAS - GHSL-2023-009

Priority HIGH 66

Apereo CAS is an open source multilingual single sign-on solution for the web.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00503 Published 2023-06-27 Fixed in 6.5.9.1, 6.6.6 CWE-200
TI-2019-08019 CVE-2019-10754 · GHSA-g24w-373r-5pxg

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache…

Priority LOW 39

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01767 Published 2019-09-23 Fixed in 6.1.0-RC5 CWE-338