PT-2021-23633 · Apereo · Apereo Cas

Caio Farias · Published 2021-12-07 · Updated 2021-12-10 · CVE-2021-42567

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apereo CAS versions through 6.4.1

Description The issue allows for XSS via POST requests sent to the REST API endpoints.

Recommendations For Apereo CAS versions through 6.4.1, consider restricting access to the REST API endpoints as a temporary workaround until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-42567

GHSA-GFHX-JJWQ-63GV

Affected Products

Apereo Cas

References · 10

• https://apereo.github.io/2021/10/18/restvuln · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-42567 · Security Note
• https://osv.dev/vulnerability/GHSA-gfhx-jjwq-63gv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-42567 · Vendor Advisory
• https://github.com/apereo/cas/releases · Note
• https://github.com/apereo/cas · Note
• https://github.com/apereo/cas/commit/376bf087d6d4267f61fc9f8028aa0d1ef407c3f0 · Note
• https://t.me/cvenotify/24479 · Telegram Post
• https://t.me/cvenotify/24372 · Telegram Post
• https://t.me/cibsecurity/33537 · Telegram Post