A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
History

Tue, 19 Nov 2024 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Apereo central Authentication Service
CPEs cpe:2.3:a:apereo:central_authentication_service:6.6.0:-:*:*:*:*:*:*
Vendors & Products Apereo central Authentication Service

Thu, 14 Nov 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Apereo
Apereo cas Server
CPEs cpe:2.3:a:apereo:cas_server:*:*:*:*:*:*:*:*
Vendors & Products Apereo
Apereo cas Server
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Thu, 14 Nov 2024 13:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Apereo CAS login session expiration
Weaknesses CWE-613
References
Metrics cvssV2_0

{'score': 2.6, 'vector': 'AV:N/AC:H/Au:N/C:P/I:N/A:N'}

cvssV3_0

{'score': 3.7, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2024-11-14T13:31:04.929Z

Updated: 2024-11-14T14:31:21.251Z

Reserved: 2024-11-14T06:53:14.390Z

Link: CVE-2024-11208

cve-icon Vulnrichment

Updated: 2024-11-14T14:30:17.188Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-14T14:15:17.787

Modified: 2024-11-19T19:38:51.637

Link: CVE-2024-11208

cve-icon Redhat

No data.