Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-4612

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.

Published

2023-11-09T14:15:08.183

Last Modified

2025-02-26T22:15:11.710

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

Weaknesses
  • Type: Secondary
    CWE-302
  • Type: Primary
    CWE-287
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apereo central_authentication_service < 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
Application apereo central_authentication_service 7.0.0 Yes
References