GitHub Advisoryadvisory · Packagist

GHSA-45ch-hxgr-vx8j phpCAS client library and Moodle Cross-site Scripting vulnerability

MEDIUM Published 2022-05-13 Modified 2024-02-07 Official page ↗
Aliases
CVE-2010-1618
Ecosystem
Packagist
Packages
apereo/phpcas, moodle/moodle
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-07

Affected packages

• Packagist apereo/phpcas: < 1.1.0 → fixed in 1.1.0 • Packagist moodle/moodle: >= 1.8.0, < 1.8.12 → fixed in 1.8.12 • Packagist moodle/moodle: >= 1.9.0, < 1.9.8 → fixed in 1.9.8

Description

Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message.

Related

Alias · CVE (1)

  • CVE-2010-1618 Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References