| Package | Affected versions | Patched versions |
|---|---|---|
| org.apereo.cas:cas-server-core-services-api | < 6.1.0-RC5 | 6.1.0-RC5 |
| org.apereo.cas:cas-server-core-services-authentication | < 6.1.0-RC5 | 6.1.0-RC5 |
| org.apereo.cas:cas-server-support-oauth-core-api | < 6.1.0-RC5 | 6.1.0-RC5 |
| org.apereo.cas:cas-server-support-oidc | < 6.1.0-RC5 | 6.1.0-RC5 |
| org.apereo.cas:cas-server-support-shell | < 6.1.0-RC5 | 6.1.0-RC5 |
| org.apereo.cas:cas-server-support-simple-mfa | < 6.1.0-RC5 | 6.1.0-RC5 |
| central authentication service | = 6.1.0≤ 6.0.5.1 |
Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free