CVE-2020-27178: Improper Authentication in Apereo CAS
Summary
CVE-2020-27178: Improper Authentication in Apereo CAS. Affects org.apereo.cas:cas-server-webapp across 3 version ranges.
>= 5.3.0, < 5.3.16
>= 6.0.0, < 6.1.7.2
>= 6.2.0, < 6.2.4
Fixed in 5.3.16, 6.1.7.2 or 6.2.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apereo CAS is an open-source enterprise Single Sign-On (SSO) system for web applications. It provides authentication and authorization services, allowing users to access multiple applications with a single set of credentials. The cas-server-webapp and cas-server-support-otp-mfa-core packages are components of Apereo CAS that handle web application functionality and support for one-time password (OTP) multi-factor authentication, respectively.
Vulnerability Detail
The vulnerability identified as CVE-2020-27178 affects Apereo CAS versions 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4. It involves improper handling of secret keys when using Google Authenticator for multifactor authentication. This vulnerability could allow an attacker to bypass authentication and gain unauthorized access to protected resources. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.3.0, < 5.3.165.3.16 -
>= 6.0.0, < 6.1.7.26.1.7.2 -
>= 6.2.0, < 6.2.46.2.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in Apereo CAS versions 5.3.x, 6.x, and 6.2.x before the specified patched versions could allow unauthorized access to protected resources. It is crucial to upgrade to the latest fixed versions or apply the official patches to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apereo.cas:cas-server-webapp →
FAQ
Apereo CAS is an open-source enterprise Single Sign-On (SSO) system for web applications. It provides authentication and authorization services, allowing users to access multiple applications with a single set of credentials.
This vulnerability could allow an attacker to bypass authentication and gain unauthorized access to protected resources.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Apereo CAS. Please refer to the 'how_to_fix' section for specific version information.
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions.
