Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
osvGoogleOSV:GHSA-9FC5-Q25C-R2WR
HistoryMay 17, 2022 - 7:57 p.m.

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

2022-05-1719:57:18
Google
osv.dev
10
jasig java cas client
.net client
phpcas
url parameter injection
vulnerability
back-channel ticket
cas protocol
remote attackers
arbitrary web script
html
service parameter
pgturl parameter
validation.

EPSS

0.024

Percentile

90.0%

JSON

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Related

ubuntucve 1
openvas 4
nessus 4
debian 1
veracode 1
prion 1
debiancve 1
osv 1
fedora 1
cvelist 1
securityvulns 2
cve 1
mageia 1
github 1
nvd 1
redhat 1
ubuntucve
ubuntucve
CVE-2014-4172
2020-01-24 00:00:00
openvas
openvas
Fedora Update for cas-client FEDORA-2014-9662
2014-08-31 00:00:00
Debian Security Advisory DSA 3017-1 (php-cas - security update)
2014-09-02 00:00:00
Debian: Security Advisory (DSA-3017-1)
2014-09-01 00:00:00
nessus
nessus
Debian DSA-3017-1 : php-cas - security update
2014-09-04 00:00:00
Fedora 20 : cas-client-3.3.3-1.fc20 (2014-9662)
2014-08-30 00:00:00
Moodle < 2.5 / 2.5.x < 2.5.8 / 2.6.x < 2.6.5 / 2.7.x < 2.7.2 Multiple Vulnerabilities
2015-04-20 00:00:00
debian
debian
[SECURITY] [DSA 3017-1] php-cas security update
2014-09-02 16:40:14
veracode
veracode
Cross-site Scripting (XSS)
2020-01-28 05:19:07
prion
prion
Code injection
2020-01-24 19:15:00
debiancve
debiancve
CVE-2014-4172
2020-01-24 19:15:12
osv
osv
php-cas - security update
2014-09-02 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: cas-client-3.3.3-1.fc20
2014-08-30 03:58:45
cvelist
cvelist
CVE-2014-4172
2020-01-24 18:29:32
securityvulns
securityvulns
[SECURITY] [DSA 3017-1] php-cas security update
2014-10-15 00:00:00
Web applications security vulnerabilities summary &#40;PHP, ASP, JSP, CGI, Perl&#41;
2014-10-15 00:00:00
cve
cve
CVE-2014-4172
2020-01-24 19:15:12
mageia
mageia
Updated php-pear-CAS packages fix CVE-2014-4172
2014-09-24 20:44:28
github
github
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
2022-05-17 19:57:18
nvd
nvd
CVE-2014-4172
2020-01-24 19:15:12
redhat
redhat
(RHSA-2015:1009) Important: Red Hat JBoss Portal 6.2.0 update
2015-05-14 15:12:54

EPSS

0.024

Percentile

90.0%

JSON
Related for OSV:GHSA-9FC5-Q25C-R2WR
ubuntucve1openvas4nessus4debian1veracode1prion1debiancve1osv1fedora1cvelist1securityvulns2cve1mageia1github1nvd1redhat1