← back
CVE-2025-3986

Apereo CAS CasConfigurationMetadataServerController.java redos

CVSS 5.3 MEDIUMEPSS 0.5%CWE-1333CWE-400
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 5.3EPSS 0.5%KEV nãoPoC Nuclei Metasploit Patch
Lifecycle
27 Apr 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
Apereo · CAS

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →