CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-39369 – Service Hostname Discovery Exploitation in phpCAS
https://notcve.org/view.php?id=CVE-2022-39369
01 Nov 2022 — phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in worst case this... • https://github.com/apereo/phpCAS/security/advisories/GHSA-8q72-6qq8-xv64 • CWE-99: Improper Control of Resource Identifiers ('Resource Injection') CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 9.8EPSS: 6%CPEs: 5EXPL: 0CVE-2014-4172 – cas-client: Bypass of security constraints via URL parameter injection
https://notcve.org/view.php?id=CVE-2014-4172
02 Sep 2014 — A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java. Se detectó una vulnerabilidad de inyección de parámetros de URL en el paso de validaci... • http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-5583
https://notcve.org/view.php?id=CVE-2012-5583
06 Jun 2014 — phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. phpCAS anterior a 1.3.2 no verifica que el nombre del servidor coincide con un nombre de dominio en el campo del asunto Common Name (CN) o subjectAltName del certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL... • http://secunia.com/advisories/51818 • CWE-310: Cryptographic Issues •