cve.bz

CVE-2019-10754

8.1 highEPSS 1.8%

High (8.1) in apereo central authentication service. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in org.apereo.cas:cas-server-support-simple-mfa 6.1.0-RC5.

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Severity

CVSS 3.1

8.1 high
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS
1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE
CWE-338
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-support-simple-mfa<6.1.0-RC56.1.0-RC5
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-support-oidc<6.1.0-RC56.1.0-RC5
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-core-services-api<6.1.0-RC56.1.0-RC5
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-support-oauth-core-api<6.1.0-RC56.1.0-RC5
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-support-shell<6.1.0-RC56.1.0-RC5
GHSA-g24w-373r-5pxgMavenorg.apereo.cas:cas-server-core-services-authentication<6.1.0-RC56.1.0-RC5

References

Check your stackJSON