GitHub Advisoryadvisory · NuGet, Maven, Packagist

GHSA-9fc5-q25c-r2wr Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

CRITICAL Published 2022-05-17 Modified 2024-04-12 Official page ↗
Aliases
CVE-2014-4172
Ecosystem
NuGet, Maven, Packagist
Packages
DotNetCasClient, org.jasig.cas:cas-client, jasig/phpcas
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-11-22

Affected packages

• NuGet DotNetCasClient: < 1.0.2 → fixed in 1.0.2 • Maven org.jasig.cas:cas-client: < 3.3.2 → fixed in 3.3.2 • Packagist jasig/phpcas: < 1.3.3 → fixed in 1.3.3

Description

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Related

Alias · CVE (1)

  • CVE-2014-4172 A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References