CVE-2019-10755 - OpenCVE

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Pac4j	Pac4j

Configuration 1 [-]

cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*

References

Link	Resource
https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407	Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: snyk

Published: 2019-09-23T22:13:04

Updated: 2019-09-23T22:13:04

Reserved: 2019-04-03T00:00:00

Link: CVE-2019-10755

JSON object: View

NVD Information

Status : Analyzed

Published: 2019-09-23T23:15:10.737

Modified: 2019-09-24T14:08:44.430

Link: CVE-2019-10755

JSON object: View

Redhat Information

No data.

CWE

CWE-338

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pac4j:pac4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "AEFF7FAC-FFC4-4951-8FF5-B0F8AA9180E8", "versionEndIncluding": "3.8.2", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml."}, {"lang": "es", "value": "Se encontr\u00f3 que el identificador SAML generado dentro del archivo SAML2Utils.java utiliza la clase RacheStringUtils de apache commons-lang3 que los hace predecibles debido a que el algoritmo de RandomStringUtils PRNG no es criptogr\u00e1ficamente fuerte. Este problema solo afecta a las versiones 3.X publicaci\u00f3n de pac4j-saml."}], "id": "CVE-2019-10755", "lastModified": "2019-09-24T14:08:44.430", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-23T23:15:10.737", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JAVA-ORGPAC4J-467407"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-338"}], "source": "nvd@nist.gov", "type": "Primary"}]}