CVE-2019-10754

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-338

Affected software

Vendor	Product	Versions
n/a	Apereo CAS	All versions prior to version 6.1.0-RC5

References

https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868Exploit, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869Exploit, Patch, Third Party Advisory

Timeline

Published: Sep 23, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107554.9The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes t CVE-2019-107565.4It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw CVE-2019-107579.8knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, all CVE-2019-107589.9mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` depende CVE-2019-107599.9safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execut CVE-2019-10765.4A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foun CVE-2019-107609.9safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execut CVE-2019-107618.3This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" conte CVE-2019-107629.8columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.CVE-2019-107636.5pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL inje CVE-2019-107647.4In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private ke CVE-2019-107659.8iobroker.admin before 3.6.12 allows attacker to include file contents from outside the `/log/file1/` directory.