CVE-2023-4612: MFA bypass in Apereo CAS
First published: Thu Nov 09 2023(Updated: )
Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.
Credit: cvd@cert.pl
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apereo Central Authentication Service | <7.0.0 | |
| Apereo Central Authentication Service | =7.0.0-rc1 | |
| Apereo Central Authentication Service | =7.0.0-rc2 | |
| Apereo Central Authentication Service | =7.0.0-rc3 | |
| Apereo Central Authentication Service | =7.0.0-rc4 | |
| Apereo Central Authentication Service | =7.0.0-rc5 | |
| Apereo Central Authentication Service | =7.0.0-rc6 | |
| Apereo Central Authentication Service | =7.0.0-rc7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this MFA bypass vulnerability in Apereo CAS?
The vulnerability ID for this MFA bypass vulnerability in Apereo CAS is CVE-2023-4612.
What is the severity of CVE-2023-4612?
The severity of CVE-2023-4612 is critical with a CVSS score of 9.8.
Which version of Apereo CAS is affected by CVE-2023-4612?
Apereo CAS versions up to and including 7.0.0-RC7 are affected by CVE-2023-4612.
How does this vulnerability in Apereo CAS allow MFA bypass?
This vulnerability in Apereo CAS allows MFA bypass by exploiting an improper authentication issue in the 'jakarta.servlet.http.HttpServletRequest.getRemoteAddr' method.
Are there any known fixes for CVE-2023-4612?
At the time of publication, it is unknown whether new versions of Apereo CAS address the vulnerability.
- agent/type
- agent/references
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/author
- agent/title
- agent/severity
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/apereo
- canonical/apereo central authentication service
- version/apereo central authentication service/7.0.0-rc1
- version/apereo central authentication service/7.0.0-rc2
- version/apereo central authentication service/7.0.0-rc3
- version/apereo central authentication service/7.0.0-rc4
- version/apereo central authentication service/7.0.0-rc5
- version/apereo central authentication service/7.0.0-rc6
- version/apereo central authentication service/7.0.0-rc7