CVEs-PoC/2019/CVE-2019-10754.md

CVE-2019-10754

Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

POC

Reference

• https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402
• https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404
• https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406
• https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868
• https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869

Github

No PoCs found on GitHub currently.