Vulnerabilities > CVE-2019-10754 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apereo Central Authentication Service

CVSS 5.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

SINGLE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

apereo

CWE-338

NVD

Published: 2019-09-23

Updated: 2019-09-24

Summary

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Vulnerable Configurations

Part	Description	Count
Application	Apereo Apereo Central Authentication Service 3.0 Apereo Central Authentication Service 3.0.1 Apereo Central Authentication Service 3.0.1.1 Apereo Central Authentication Service 3.0.2 Apereo Central Authentication Service 3.0.2.1 Apereo Central Authentication Service 3.0.3 Apereo Central Authentication Service 3.0.3.1 Apereo Central Authentication Service 3.0.3.2 Apereo Central Authentication Service 3.0.4 Apereo Central Authentication Service 3.0.4.1 Apereo Central Authentication Service 3.0.4.2 Apereo Central Authentication Service 3.0.5 Apereo Central Authentication Service 3.0.5.1 Apereo Central Authentication Service 3.0.5.2 Apereo Central Authentication Service 3.0.5.3 Apereo Central Authentication Service 3.0.6 Apereo Central Authentication Service 3.0.6.1 Apereo Central Authentication Service 3.0.7 Apereo Central Authentication Service 3.0.7.1 Apereo Central Authentication Service 3.1.0 Apereo Central Authentication Service 3.1.1 Apereo Central Authentication Service 3.1.1.1 Apereo Central Authentication Service 3.1.1.2 Apereo Central Authentication Service 3.1.2 Apereo Central Authentication Service 3.1.3 Apereo Central Authentication Service 3.1.4 Apereo Central Authentication Service 3.2.0 Apereo Central Authentication Service 3.2.0.1 Apereo Central Authentication Service 3.2.0.2 Apereo Central Authentication Service 3.2.0.3 Apereo Central Authentication Service 3.2.0.4 Apereo Central Authentication Service 3.2.1 Apereo Central Authentication Service 3.2.1.1 Apereo Central Authentication Service 3.2.1.2 Apereo Central Authentication Service 3.2.2.1 Apereo Central Authentication Service 3.3.0 Apereo Central Authentication Service 3.3.1 Apereo Central Authentication Service 3.3.2 Apereo Central Authentication Service 3.3.3 Apereo Central Authentication Service 3.3.4 Apereo Central Authentication Service 3.3.5 Apereo Central Authentication Service 3.3.5.1 Apereo Central Authentication Service 3.4.0 Apereo Central Authentication Service 3.4.1 Apereo Central Authentication Service 3.4.2 Apereo Central Authentication Service 3.4.2.1 Apereo Central Authentication Service 3.4.3 Apereo Central Authentication Service 3.4.3.1 Apereo Central Authentication Service 3.4.4 Apereo Central Authentication Service 3.4.5 Apereo Central Authentication Service 3.4.6 Apereo Central Authentication Service 3.4.7 Apereo Central Authentication Service 3.4.8 Apereo Central Authentication Service 3.4.9 Apereo Central Authentication Service 3.4.10 Apereo Central Authentication Service 3.4.11 Apereo Central Authentication Service 3.4.12 Apereo Central Authentication Service 3.4.12.1 Apereo Central Authentication Service 3.5.0 Apereo Central Authentication Service 3.5.1 Apereo Central Authentication Service 3.5.2 Apereo Central Authentication Service 3.5.2-Cas-1181 Apereo Central Authentication Service 3.5.2.1 Apereo Central Authentication Service 3.5.3 Apereo Central Authentication Service 3.6.0 Apereo Central Authentication Service 4.0.0 Apereo Central Authentication Service 4.0.1 Apereo Central Authentication Service 4.0.2 Apereo Central Authentication Service 4.0.3 Apereo Central Authentication Service 4.0.4 Apereo Central Authentication Service 4.0.5 Apereo Central Authentication Service 4.0.6 Apereo Central Authentication Service 4.0.7 Apereo Central Authentication Service 4.1.0 Apereo Central Authentication Service 4.1.1 Apereo Central Authentication Service 4.1.2 Apereo Central Authentication Service 4.1.3 Apereo Central Authentication Service 4.1.4 Apereo Central Authentication Service 4.1.5 Apereo Central Authentication Service 4.1.6 Apereo Central Authentication Service 4.1.7 Apereo Central Authentication Service 4.1.8 Apereo Central Authentication Service 4.1.9 Apereo Central Authentication Service 4.1.10 Apereo Central Authentication Service 4.2.0 Apereo Central Authentication Service 4.2.1 Apereo Central Authentication Service 4.2.2 Apereo Central Authentication Service 4.2.3 Apereo Central Authentication Service 4.2.4 Apereo Central Authentication Service 4.2.5 Apereo Central Authentication Service 4.2.6 Apereo Central Authentication Service 4.2.7 Apereo Central Authentication Service 5.0.0 Apereo Central Authentication Service 5.0.1 Apereo Central Authentication Service 5.0.2 Apereo Central Authentication Service 5.0.3 Apereo Central Authentication Service 5.0.3.1 Apereo Central Authentication Service 5.0.4 Apereo Central Authentication Service 5.0.5 Apereo Central Authentication Service 5.0.6 Apereo Central Authentication Service 5.0.7 Apereo Central Authentication Service 5.0.8 Apereo Central Authentication Service 5.0.9 Apereo Central Authentication Service 5.0.10 Apereo Central Authentication Service 5.1.0 Apereo Central Authentication Service 5.1.1 Apereo Central Authentication Service 5.1.2 Apereo Central Authentication Service 5.1.3 Apereo Central Authentication Service 5.1.4 Apereo Central Authentication Service 5.1.5 Apereo Central Authentication Service 5.1.6 Apereo Central Authentication Service 5.1.7 Apereo Central Authentication Service 5.1.8 Apereo Central Authentication Service 5.1.9 Apereo Central Authentication Service 5.2.0 Apereo Central Authentication Service 5.2.1 Apereo Central Authentication Service 5.2.2 Apereo Central Authentication Service 5.2.3 Apereo Central Authentication Service 5.2.4 Apereo Central Authentication Service 5.2.5 Apereo Central Authentication Service 5.2.6 Apereo Central Authentication Service 5.2.7 Apereo Central Authentication Service 5.2.8 Apereo Central Authentication Service 5.2.9 Apereo Central Authentication Service 5.3.0 Apereo Central Authentication Service 5.3.1 Apereo Central Authentication Service 5.3.2 Apereo Central Authentication Service 5.3.3 Apereo Central Authentication Service 5.3.4 Apereo Central Authentication Service 5.3.5 Apereo Central Authentication Service 5.3.6 Apereo Central Authentication Service 5.3.7 Apereo Central Authentication Service 5.3.8 Apereo Central Authentication Service 5.3.9 Apereo Central Authentication Service 5.3.10 Apereo Central Authentication Service 5.3.11 Apereo Central Authentication Service 5.3.12 Apereo Central Authentication Service 5.3.12.1 Apereo Central Authentication Service 6.0.0 Apereo Central Authentication Service 6.0.1 Apereo Central Authentication Service 6.0.2 Apereo Central Authentication Service 6.0.3 Apereo Central Authentication Service 6.0.4 Apereo Central Authentication Service 6.0.5 Apereo Central Authentication Service 6.0.5.1 Apereo Central Authentication Service 6.1.0	199

Common Weakness Enumeration (CWE)

CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References