Apereo · Apereo Central Authentication Service (Cas) Server · CVE-2015-1169
**Name of the Vulnerable Software and Affected Versions**
Apereo Central Authentication Service (CAS) Server versions prior to 3.5.3
**Description**
The issue allows remote attackers to conduct LDAP injection attacks via a crafted `username`, potentially bypassing LDAP authentication. This can be achieved by using a wildcard and a valid `password`.
**Recommendations**
For versions prior to 3.5.3, update to version 3.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the LDAP authentication mechanism until the update is applied. Avoid using wildcard characters in the `username` field to minimize the risk of exploitation.