Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-3985

A vulnerability was found in Apereo CAS 5.2.6. It has been classified as problematic. This affects the function ResponseEntity of the file cas-5.2.6\webapp-mgmt\cas-management-webapp-support\src\main\java\org\apereo\cas\mgmt\services\web\ManageRegisteredServicesMultiActionController.java. The manipulation of the argument Query leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Published

2025-04-27T21:15:16.300

Last Modified

2025-11-05T21:30:18.360

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 2.7 (LOW)

CVSSv2 Vector

AV:N/AC:L/Au:M/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: MULTIPLE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

6.4

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-400
    CWE-1333
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apereo central_authentication_service 5.2.6 Yes
References