{"id":"CVE-2019-10754","details":"Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.","aliases":["GHSA-g24w-373r-5pxg"],"modified":"2026-08-27T08:40:52.492750Z","published":"2019-09-23T23:15:10.640Z","related":["SNYK-JAVA-ORGAPEREOCAS-467402","SNYK-JAVA-ORGAPEREOCAS-467404","SNYK-JAVA-ORGAPEREOCAS-467406","SNYK-JAVA-ORGAPEREOCAS-468868","SNYK-JAVA-ORGAPEREOCAS-468869"],"references":[{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467402"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467404"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-467406"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468868"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGAPEREOCAS-468869"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apereo/cas","events":[{"introduced":"0"},{"last_affected":"c5fb7272b09461ff54f3f8ed055404fa076cb1f3"},{"introduced":"c5982f32f7e289281530ade735e25c535e73a3ae"},{"last_affected":"5cf41c7f44c4cef5c00233e5e3931ceae5f8c5b0"}],"database_specific":{"cpe":["cpe:2.3:a:apereo:central_authentication_service:*:*:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc1:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc2:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc3:*:*:*:*:*:*","cpe:2.3:a:apereo:central_authentication_service:6.1.0:rc4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"6.0.5.1"},{"introduced":"6.1.0-rc1"},{"last_affected":"6.1.0-rc1"},{"introduced":"6.1.0-rc2"},{"last_affected":"6.1.0-rc2"},{"introduced":"6.1.0-rc3"},{"last_affected":"6.1.0-rc3"},{"introduced":"6.1.0-rc4"},{"last_affected":"6.1.0-rc4"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["6.1.0-rc1","6.1.0-rc2","6.1.0-rc3","6.1.0-rc4","v6.0.5.1","v6.0.5","v6.1.0-RC4","v6.1.0-RC3","v6.0.0-RC4","v6.0.0-RC3","v5.2.0-RC1","v5.1.0-RC4","v5.1.0-RC3","v5.1.0-RC1","v5.1.0.RC1","v5.0.0","v5.0.0.RC4","v5.0.0.RC3","v5.0.0.RC2","v5.0.0.RC1","v4.1.0-RC2","v4.1.0-RC1","v4.0.0","v4.0.0-RC4","v4.0.0-RC3","v4.0.0-RC2","v4.0.0-RC1","v3.5.1-RC1","v3.5.0","v3.5.0-RC2","v3.5.0-RC1","v3.4.11","3.4.11-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-10754.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}]}