CVE-2025-3984: Apereo CAS 5.2.6 Code Injection Vulnerability
Summary
CVE-2025-3984: Apereo CAS code injection vulnerability. Affects org.apereo.cas:cas-management-webapp-support versions < 5.2.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apereo CAS (Central Authentication Service) is an open-source enterprise single sign-on solution for the web. It allows users to authenticate once and gain access to multiple applications without needing to log in again. The CAS management web application supports the administration of registered services, enabling administrators to manage service configurations and security settings. However, version 5.2.6 of the CAS management webapp has been found to contain a critical vulnerability that exposes it to code injection attacks.
Vulnerability Detail
A critical code injection vulnerability exists in the saveService function of the RegisteredServiceSimpleFormController.java file within the Apereo CAS 5.2.6 package. This vulnerability allows an attacker to manipulate Groovy code execution remotely, potentially leading to unauthorized access or control over the application. The complexity of exploiting this vulnerability is high, and while the exploit has been publicly disclosed, successful exploitation requires advanced technical skills.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the CAS management web application to trusted IP addresses only, thereby minimizing the risk of remote exploitation until a patch can be applied.
Conclusion
The Apereo CAS 5.2.6 code injection vulnerability poses a significant risk to applications using this version. It is crucial for users to update to a patched version to mitigate potential exploitation. Implementing temporary workarounds can help reduce risk until a full update is feasible.
See every vulnerability recorded for org.apereo.cas:cas-management-webapp-support →
FAQ
The vulnerability is a code injection issue that allows attackers to execute arbitrary Groovy code remotely.
The vulnerability affects Apereo CAS version 5.2.6.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.0, indicating a moderate severity level.
If immediate updates are not possible, implement IP whitelisting to restrict access to the management interface as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for org.apereo.cas:cas-management-webapp-support.
