CVE-2015-1169: Apereo Central Authentication Service

High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days.

Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication.

Affected products

• Apereo Central Authentication Service: up to and including 3.5.2

Published 2015-02-10. Last modified 2026-06-17.