Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| org.apereo.cas:cas-server-support-simple-mfa(Maven) | 0 | 6.1.0-RC5 | N/A |
| org.apereo.cas:cas-server-support-oidc(Maven) | 0 | 6.1.0-RC5 | N/A |
| org.apereo.cas:cas-server-core-services-api(Maven) | 0 | 6.1.0-RC5 | N/A |
| org.apereo.cas:cas-server-support-oauth-core-api(Maven) | 0 | 6.1.0-RC5 | N/A |
| org.apereo.cas:cas-server-support-shell(Maven) | 0 | 6.1.0-RC5 | N/A |
| org.apereo.cas:cas-server-core-services-authentication(Maven) | 0 | 6.1.0-RC5 | N/A |
CVSS Metrics
