CVE-2025-3986 — Vulnetix

Try Vulnetix Request Demo

CVE-2025-3986 PUBLISHED CVSS 5.300000190734863 MEDIUM

A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

EPSS 0.59% · 68.9th percentile

Risk Scores

CVSS v4.0

5.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

EPSS Score

0.59%

68.9th percentile

Affected Products

Vendor	Product	Versions
Maven	org.apereo.cas:cas-server-core-configuration-metadata-repository	0, 0
Apereo	CAS	5.2.6, 5.2.6
apereo	central_authentication_service	5.2.6, 5.2.6

Timeline

Apr 27, 2025 CVE Published
Apr 27, 2025 PoC Published
Apr 27, 2025 PoC Published
Apr 28, 2025 CVE Updated
Apr 28, 2025 EPSS Score
Apr 28, 2025 PoC Published
May 9, 2025 EPSS Score
May 21, 2025 EPSS Score
Jun 1, 2025 EPSS Score
Jun 13, 2025 EPSS Score
Jun 24, 2025 EPSS Score
Jul 5, 2025 EPSS Score

References

https://wx.mail.qq.com/s?k=rk-m8GwRMVMcOjBY1a url
https://vuldb.com/?ctiid.306322 technical
https://vuldb.com/?id.306322 advisory
https://vuldb.com/?submit.557473 advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-3986 advisory
https://github.com/apereo/cas package

Open in Interactive Console →