Vulnerability · Published Nov 14, 2024 · Assigned by VulDB

CVE-2024-11209Apereo CAS 2FA login improper authentication

Medium 6.3

In plain English

A medium-severity improper authentication in CAS from Apereo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.6%top 50.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Apereo	CAS	6.6

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-284523 | Apereo CAS 2FA login improper authentication vdb-entry
VDB-284523 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #437238 | Apereo CAS 6.6 Authentication Bypass Issues third-party-advisory
https://gist.github.com/0xArthurSouza/281e8ea8a797abc8371a8ced31dc5562 exploit