cas-client is vulnerable to cross-site scripting (XSS). The vulnerability exists as the value of value
from URL encoded parameters in AbstractUrlBasedTicketValidator.java
is not sanitized.
lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html
apereo.atlassian.net/browse/CASC-228
bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718
bugzilla.redhat.com/show_bug.cgi?id=1131350
exchange.xforce.ibmcloud.com/vulnerabilities/95673
github.com/apereo/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814
github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d
github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814
github.com/Jasig/phpCAS/blob/master/docs/ChangeLog
github.com/Jasig/phpCAS/pull/125
issues.jasig.org/browse/CASC-228
www.debian.org/security/2014/dsa-3017.en.html
www.mail-archive.com/[email protected]/msg17338.html