Skip to main content

Central Authentication Service CVE-2019-10754

HIGH
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)
2019-09-23 report@snyk.io
Information Disclosure Apache Central Authentication Service
8.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 23, 2019 - 23:15 nvd
HIGH 8.1

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 231 maven packages depend on org.apereo.cas:cas-server-core-services-api (125 direct, 106 indirect)
  • 218 maven packages depend on org.apereo.cas:cas-server-core-services-authentication (35 direct, 183 indirect)
  • 7 maven packages depend on org.apereo.cas:cas-server-support-oauth-core-api (7 direct, 0 indirect)

Ecosystem-wide dependent count for version 6.1.0-RC5 and other introduced versions.

DescriptionNVD

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

AnalysisAI

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-338. Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. Affected products include: Apereo Central Authentication Service.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Central Authentication Service

View all
CVE-2024-4399 CRITICAL POC
9.1 May 23

The does not validate a parameter before making a request to it, which could allow unauthenticated users to perform SSRF
CVE-2015-1169 HIGH POC
7.5 Feb 10

Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attack
CVE-2024-11208 MEDIUM POC
6.3 Nov 14

A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Rated medium severity (CVSS 6.3), this vulner
CVE-2021-42567 MEDIUM POC
6.1 Dec 07

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. Rated medium severity (CVSS 6.1),

CVE-2023-4612 CRITICAL
9.8 Nov 09

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allo
CVE-2024-11209 MEDIUM POC
5.3 Nov 14

A vulnerability was found in Apereo CAS 6.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitabl
CVE-2024-11207 MEDIUM POC
5.3 Nov 14

A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Rated medium severity (CVSS 5.3), this v
CVE-2023-28857 HIGH
7.5 Jun 27

Apereo CAS is an open source multilingual single sign-on solution for the web. Rated high severity (CVSS 7.5), this vuln
CVE-2020-27178 HIGH
7.5 Oct 16

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret key
CVE-2025-3986 MEDIUM
5.3 Apr 27

A vulnerability was found in Apereo CAS 5.2.6. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita
CVE-2025-3985 MEDIUM
5.1 Apr 27

A vulnerability was found in Apereo CAS 5.2.6. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploita
CVE-2025-3984 LOW
2.3 Apr 27

A vulnerability was found in Apereo CAS 5.2.6 and classified as critical. Rated low severity (CVSS 2.3), this vulnerabil

Same weakness CWE-338 – Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

View all
CVE-2023-36993 CRITICAL POC
9.8
CVE-2019-16303 CRITICAL POC
9.8
CVE-2024-29868 CRITICAL POC
9.1
CVE-2022-35255 CRITICAL POC
9.1
CVE-2025-1796 HIGH POC
8.8
CVE-2023-27791 HIGH POC
8.1
CVE-2019-5440 HIGH POC
8.1
CVE-2024-7315 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2019-10754 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy