CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-39369 – Service Hostname Discovery Exploitation in phpCAS
https://notcve.org/view.php?id=CVE-2022-39369
01 Nov 2022 — phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this... • https://github.com/apereo/phpCAS/security/advisories/GHSA-8q72-6qq8-xv64 • CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2012-1105
https://notcve.org/view.php?id=CVE-2012-1105
05 Dec 2019 — An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory. The Central Authentication Service client library archives the debug logging file in an insecure manner. Se presenta una vulnerabilidad de Divulgación de Información en el paquete Jasig Project php-pear-CAS versión 1.2.2 en el directorio /tmp. La biblioteca del cliente Central Authentication Service guarda el archivo de registro de depuración de manera no segura. • http://www.openwall.com/lists/oss-security/2012/03/05/7 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 1%CPEs: 3EXPL: 0CVE-2012-1104
https://notcve.org/view.php?id=CVE-2012-1104
05 Dec 2019 — A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed. Se presenta una vulnerabilidad de Omisión de Seguridad en la biblioteca phpCAS versión 1.2.2 del proyecto jasig debido a la manera en que el proxy de servicios es administrado. • http://www.openwall.com/lists/oss-security/2012/03/05/7 • CWE-269: Improper Privilege Management •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000071
https://notcve.org/view.php?id=CVE-2017-1000071
13 Jul 2017 — Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server. Jasig phpCAS versión 1.3.4, es vulnerable a una omisión de autenticación en la función validateCAS20 cuando se configura para autenticarse en un antiguo servidor CAS. • http://www.securityfocus.com/bid/99609 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 6%CPEs: 5EXPL: 0CVE-2014-4172 – cas-client: Bypass of security constraints via URL parameter injection
https://notcve.org/view.php?id=CVE-2014-4172
02 Sep 2014 — A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java. Se detectó una vulnerabilidad de inyección de parámetros de URL en el paso de validaci... • http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-5583
https://notcve.org/view.php?id=CVE-2012-5583
06 Jun 2014 — phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. phpCAS anterior a 1.3.2 no verifica que el nombre del servidor coincide con un nombre de dominio en el campo del asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL... • http://secunia.com/advisories/51818 • CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 0%CPEs: 30EXPL: 0CVE-2010-3690
https://notcve.org/view.php?id=CVE-2010-3690
07 Oct 2010 — Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en phpCAS anterior a v1.1.3, ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 30EXPL: 0CVE-2010-3691
https://notcve.org/view.php?id=CVE-2010-3691
07 Oct 2010 — PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file. PGTStorage/pgt-file.php en phpCAS anterior a v1.1.3, cuando el modo proxy está habilitado, permite a usuarios locales sobreescribir ficheros arbitrarios mediante un ataque de enlace simbólico sobre un fichero sin especificar. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 0CVE-2010-3692
https://notcve.org/view.php?id=CVE-2010-3692
07 Oct 2010 — Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter. Vulnerabilidad de salto de directorio en la función callback en client.php en phpCAS anterior a v1.1.3, cuando el modo proxy está habilitado, permite a atacantes crear o sobreescribir ficheros arbitrarios mediante secuencias de salto de di... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •