CVE-2025-3984

Summary

CVE-2025-3984 is a critical vulnerability identified in Apereo CAS 5.2.6. The issue lies in the saveService function of the file cas-management-webapp-support/src/main/java/org/apereo/cas/mgmt/services/web/RegisteredServiceSimpleFormController.java, which utilizes the Groovy Code Handler. This vulnerability allows for code injection, making it a significant security risk. The attack can be launched remotely, with a complexity level that is relatively high. The exploitation process is known to be difficult, but the exploit has been disclosed to the public. Despite being contacted about the disclosure, the vendor has not responded.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.