Vulnerability · Published Nov 9, 2023 · Assigned by CERT-PL

CVE-2023-4612MFA bypass in Apereo CAS

Critical 9.8

In plain English

A critical-severity security flaw in CAS from Apereo Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.1%top 33.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Apereo Foundation	CAS	0 – through 7.0.0-RC7

Weakness: CWE-302 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://cert.pl/posts/2023/11/CVE-2023-4612/ third-party-advisory
https://cert.pl/en/posts/2023/11/CVE-2023-4612/ third-party-advisory