Session Expiration Vulnerability in Apereo CAS by Apereo

CVE-2024-11208

What is CVE-2024-11208?

A session expiration vulnerability exists in Apereo CAS 6.6, which affects specific functionalities related to the /login?service endpoint. This vulnerability allows an attacker to manipulate session behavior, leading to unexpected session expiration. The exploit is complex, and while the possibility for remote attacks exists, the actual execution of the exploit poses significant challenges. Despite the vulnerability being publicly disclosed, there has been no communication from the vendor regarding remediation efforts, raising concerns about the security posture surrounding this product.

References