PT-2024-16824 · Apereo · Apereo Cas

Arthur Souza · Published 2024-11-14 · Updated 2024-11-17 · CVE-2024-11207

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apereo CAS version 6.6

Description A vulnerability has been found in Apereo CAS, affecting an unknown functionality of the file /login. The manipulation of the redirect uri argument leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For Apereo CAS version 6.6, update to the latest release to mitigate risks. Apply the latest patches and review security configurations to ensure the system is secure. As a temporary workaround, consider restricting access to the /login file until a patch is available. Avoid using the redirect uri argument in the affected file until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-11207

Affected Products

Apereo Cas

References · 12

• 🔥 https://gist.github.com/0xArthurSouza/68295d8fa20f18161945260fcdf842a2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-11207 · Security Note
• https://osv.dev/vulnerability/CVE-2024-11207 · Vendor Advisory
• https://vuldb.com/?submit.437207 · Note
• https://t.me/cvedetector/10947 · Telegram Post
• https://vuldb.com/?id.284521 · Note
• https://twitter.com/CVEnew/status/1857064973798621460 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1857148688444874979 · Twitter Post
• https://vuldb.com/?ctiid.284521 · Note
• https://twitter.com/transilienceai/status/1858016825067372948 · Twitter Post
• https://twitter.com/transilienceai/status/1858016819786743817 · Twitter Post
• https://t.me/cvenotify/101677 · Telegram Post