Vulnerabilities > CVE-2019-10754 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apereo Central Authentication Service

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

low complexity

apereo

CWE-338

NVD

Published: 2019-09-23

Updated: 2019-09-24

Summary

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Vulnerable Configurations

Part	Description	Count
Application	Apereo Apereo Central Authentication Service 3.0 Apereo Central Authentication Service 3.0.1 Apereo Central Authentication Service 3.0.1.1 Apereo Central Authentication Service 3.0.2 Apereo Central Authentication Service 3.0.2.1 Apereo Central Authentication Service 3.0.3 Apereo Central Authentication Service 3.0.3.1 Apereo Central Authentication Service 3.0.3.2 Apereo Central Authentication Service 3.0.4 Apereo Central Authentication Service 3.0.4.1 Apereo Central Authentication Service 3.0.4.2 Apereo Central Authentication Service 3.0.5 Apereo Central Authentication Service 3.0.5.1 Apereo Central Authentication Service 3.0.5.2 Apereo Central Authentication Service 3.0.5.3 Apereo Central Authentication Service 3.0.6 Apereo Central Authentication Service 3.0.6.1 Apereo Central Authentication Service 3.0.7 Apereo Central Authentication Service 3.0.7.1 Apereo Central Authentication Service 3.1.0 Apereo Central Authentication Service 3.1.1 Apereo Central Authentication Service 3.1.1.1 Apereo Central Authentication Service 3.1.1.2 Apereo Central Authentication Service 3.1.2 Apereo Central Authentication Service 3.1.3 Apereo Central Authentication Service 3.1.4 Apereo Central Authentication Service 3.2.0 Apereo Central Authentication Service 3.2.0.1 Apereo Central Authentication Service 3.2.0.2 Apereo Central Authentication Service 3.2.0.3 Apereo Central Authentication Service 3.2.0.4 Apereo Central Authentication Service 3.2.1 Apereo Central Authentication Service 3.2.1.1 Apereo Central Authentication Service 3.2.1.2 Apereo Central Authentication Service 3.2.2.1 Apereo Central Authentication Service 3.3.0 Apereo Central Authentication Service 3.3.1 Apereo Central Authentication Service 3.3.2 Apereo Central Authentication Service 3.3.3 Apereo Central Authentication Service 3.3.4 Apereo Central Authentication Service 3.3.5 Apereo Central Authentication Service 3.3.5.1 Apereo Central Authentication Service 3.4.0 Apereo Central Authentication Service 3.4.1 Apereo Central Authentication Service 3.4.2 Apereo Central Authentication Service 3.4.2.1 Apereo Central Authentication Service 3.4.3 Apereo Central Authentication Service 3.4.3.1 Apereo Central Authentication Service 3.4.4 Apereo Central Authentication Service 3.4.5 Apereo Central Authentication Service 3.4.6 Apereo Central Authentication Service 3.4.7 Apereo Central Authentication Service 3.4.8 Apereo Central Authentication Service 3.4.9 Apereo Central Authentication Service 3.4.10 Apereo Central Authentication Service 3.4.11 Apereo Central Authentication Service 3.4.12 Apereo Central Authentication Service 3.4.12.1 Apereo Central Authentication Service 3.5.0 Apereo Central Authentication Service 3.5.1 Apereo Central Authentication Service 3.5.2 Apereo Central Authentication Service 3.5.2-Cas-1181 Apereo Central Authentication Service 3.5.2.1 Apereo Central Authentication Service 3.5.3 Apereo Central Authentication Service 3.6.0 Apereo Central Authentication Service 4.0.0 Apereo Central Authentication Service 4.0.1 Apereo Central Authentication Service 4.0.2 Apereo Central Authentication Service 4.0.3 Apereo Central Authentication Service 4.0.4 Apereo Central Authentication Service 4.0.5 Apereo Central Authentication Service 4.0.6 Apereo Central Authentication Service 4.0.7 Apereo Central Authentication Service 4.1.0 Apereo Central Authentication Service 4.1.1 Apereo Central Authentication Service 4.1.2 Apereo Central Authentication Service 4.1.3 Apereo Central Authentication Service 4.1.4 Apereo Central Authentication Service 4.1.5 Apereo Central Authentication Service 4.1.6 Apereo Central Authentication Service 4.1.7 Apereo Central Authentication Service 4.1.8 Apereo Central Authentication Service 4.1.9 Apereo Central Authentication Service 4.1.10 Apereo Central Authentication Service 4.2.0 Apereo Central Authentication Service 4.2.1 Apereo Central Authentication Service 4.2.2 Apereo Central Authentication Service 4.2.3 Apereo Central Authentication Service 4.2.4 Apereo Central Authentication Service 4.2.5 Apereo Central Authentication Service 4.2.6 Apereo Central Authentication Service 4.2.7 Apereo Central Authentication Service 5.0.0 Apereo Central Authentication Service 5.0.1 Apereo Central Authentication Service 5.0.2 Apereo Central Authentication Service 5.0.3 Apereo Central Authentication Service 5.0.3.1 Apereo Central Authentication Service 5.0.4 Apereo Central Authentication Service 5.0.5 Apereo Central Authentication Service 5.0.6 Apereo Central Authentication Service 5.0.7 Apereo Central Authentication Service 5.0.8 Apereo Central Authentication Service 5.0.9 Apereo Central Authentication Service 5.0.10 Apereo Central Authentication Service 5.1.0 Apereo Central Authentication Service 5.1.1 Apereo Central Authentication Service 5.1.2 Apereo Central Authentication Service 5.1.3 Apereo Central Authentication Service 5.1.4 Apereo Central Authentication Service 5.1.5 Apereo Central Authentication Service 5.1.6 Apereo Central Authentication Service 5.1.7 Apereo Central Authentication Service 5.1.8 Apereo Central Authentication Service 5.1.9 Apereo Central Authentication Service 5.2.0 Apereo Central Authentication Service 5.2.1 Apereo Central Authentication Service 5.2.2 Apereo Central Authentication Service 5.2.3 Apereo Central Authentication Service 5.2.4 Apereo Central Authentication Service 5.2.5 Apereo Central Authentication Service 5.2.6 Apereo Central Authentication Service 5.2.7 Apereo Central Authentication Service 5.2.8 Apereo Central Authentication Service 5.2.9 Apereo Central Authentication Service 5.3.0 Apereo Central Authentication Service 5.3.1 Apereo Central Authentication Service 5.3.2 Apereo Central Authentication Service 5.3.3 Apereo Central Authentication Service 5.3.4 Apereo Central Authentication Service 5.3.5 Apereo Central Authentication Service 5.3.6 Apereo Central Authentication Service 5.3.7 Apereo Central Authentication Service 5.3.8 Apereo Central Authentication Service 5.3.9 Apereo Central Authentication Service 5.3.10 Apereo Central Authentication Service 5.3.11 Apereo Central Authentication Service 5.3.12 Apereo Central Authentication Service 5.3.12.1 Apereo Central Authentication Service 5.3.14 Apereo Central Authentication Service 5.3.15 Apereo Central Authentication Service 5.3.15.1 Apereo Central Authentication Service 5.3.16 Apereo Central Authentication Service 6.0.0 Apereo Central Authentication Service 6.0.1 Apereo Central Authentication Service 6.0.2 Apereo Central Authentication Service 6.0.3 Apereo Central Authentication Service 6.0.4 Apereo Central Authentication Service 6.0.5 Apereo Central Authentication Service 6.0.5.1 Apereo Central Authentication Service 6.1.0	203

Common Weakness Enumeration (CWE)

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References