Vulnerabilities > Apereo > Central Authentication Service > 6.3.0

DATE CVE VULNERABILITY TITLE RISK
2023-11-09 CVE-2023-4612 Improper Authentication vulnerability in Apereo Central Authentication Service
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7.
network
low complexity
apereo CWE-287
critical
 9.8
9.8
2021-12-07 CVE-2021-42567 Cross-site Scripting vulnerability in Apereo Central Authentication Service
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
network
apereo CWE-79
4.3
4.3
2020-10-16 CVE-2020-27178 Improper Authentication vulnerability in Apereo Central Authentication Service
Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.
network
low complexity
apereo CWE-287
5.0
5.0