Every CVE Search/ Get API key

CVE-2019-10754

Use of Insufficiently Random Values in Apereo CAS

8.1 HighFix available

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.77%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.1

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
CVE-2019-10754
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0
5.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:N
Weakness
CWE-338
Updated
2026-11-02
CVE List No score

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
CVE-2019-10754
Updated
2026-11-02
EUVDEUVD-2022-3859 No score

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
EUVD-2022-3859
Updated
2026-11-03
GitHub AdvisoriesGHSA-g24w-373r-5pxg 8.1

Use of Insufficiently Random Values in Apereo CAS

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
GHSA-g24w-373r-5pxg
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-330, CWE-338
Updated
2026-11-02
OSV 8.1

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
CVE-2019-10754
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-g24w-373r-5pxg 8.1

Use of Insufficiently Random Values in Apereo CAS

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.

Record
GHSA-g24w-373r-5pxg
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-330, CWE-338
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apereo.cas:cas-server-support-simple-mfa
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-oidc
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-core-services-api
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-oauth-core-api
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-shell
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-core-services-authentication
Maven
 before 6.1.0-RC5
6.1.0-RC5
org.apereo.cas:cas-server-support-simple-mfa
Maven
 before 6.1.0-RC5, plus listed versions
6.0.06.0.0-RC16.0.0-RC26.0.0-RC36.0.0-RC4
Show 16 moreShow less
6.0.16.0.26.0.36.0.46.0.56.0.5.16.0.66.0.76.0.86.0.8.16.1.0-RC16.1.0-RC26.1.0-RC36.1.0-RC4v6.4.0-RC5v6.4.0-RC6
6.1.0-RC5
org.apereo.cas:cas-server-support-oidc
Maven
 before 6.1.0-RC5, plus listed versions
5.0.05.0.0.M15.0.0.M25.0.0.M35.0.0.RC1
Show 45 moreShow less
5.0.0.RC25.0.0.RC35.0.0.RC45.0.15.0.105.0.25.0.35.0.3.15.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.0-RC45.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-RC15.2.0-RC25.2.0-RC35.2.0-RC45.2.15.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC2
6.1.0-RC5
org.apereo.cas:cas-server-core-services-api
Maven
 before 6.1.0-RC5, plus listed versions
5.2.05.2.0-RC25.2.0-RC35.2.0-RC45.2.1
Show 45 moreShow less
5.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC35.3.0-RC45.3.15.3.105.3.115.3.125.3.12.15.3.135.3.145.3.155.3.15.15.3.165.3.25.3.35.3.45.3.55.3.65.3.75.3.85.3.96.0.06.0.0-RC16.0.0-RC26.0.0-RC36.0.0-RC46.0.16.0.26.0.36.0.46.0.56.0.5.16.0.66.0.76.0.8
6.1.0-RC5
org.apereo.cas:cas-server-support-oauth-core-api
Maven
 before 6.1.0-RC5, plus listed versions
6.1.0-RC26.1.0-RC36.1.0-RC4v6.4.0-RC5v6.4.0-RC6
6.1.0-RC5
org.apereo.cas:cas-server-support-shell
Maven
 before 6.1.0-RC5, plus listed versions
5.0.05.0.0.M25.0.0.M35.0.0.RC15.0.0.RC2
Show 45 moreShow less
5.0.0.RC35.0.0.RC45.0.15.0.105.0.25.0.35.0.3.15.0.45.0.55.0.65.0.75.0.85.0.95.1.05.1.0-RC15.1.0-RC25.1.0-RC35.1.0-RC45.1.15.1.25.1.35.1.45.1.55.1.65.1.75.1.85.1.95.2.05.2.0-RC15.2.0-RC25.2.0-RC35.2.0-RC45.2.15.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC3
6.1.0-RC5
org.apereo.cas:cas-server-core-services-authentication
Maven
 before 6.1.0-RC5, plus listed versions
5.2.05.2.0-RC25.2.0-RC35.2.0-RC45.2.1
Show 45 moreShow less
5.2.25.2.35.2.45.2.55.2.65.2.75.2.85.2.95.3.05.3.0-RC15.3.0-RC25.3.0-RC35.3.0-RC45.3.15.3.105.3.115.3.125.3.12.15.3.135.3.145.3.155.3.15.15.3.165.3.25.3.35.3.45.3.55.3.65.3.75.3.85.3.96.0.06.0.0-RC16.0.0-RC26.0.0-RC36.0.0-RC46.0.16.0.26.0.36.0.46.0.56.0.5.16.0.66.0.76.0.8
6.1.0-RC5

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-10754 is a high vulnerability (CVSS 8.1) in Apereo Central Authentication Service, published September 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in org.apereo.cas:cas-server-support-simple-mfa 6.1.0-RC5.

References

This page doesn't list everything

Left out here: 95 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open