p PatchFirst

CVE-2014-4172

CVE-2014-4172

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

CVSS 9.8 · Critical · EPSS 6.1% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • php-cas Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.3-1

    Update to 1.3.3-1

  • php-cas Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.3-1

    Update to 1.3.3-1

  • php-cas Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.3-1

    Update to 1.3.3-1

  • dotnetcasclient NuGet

    Versions
    • 1.0.0
    • 1.0.1
    Affected ranges
    • ECOSYSTEM: < 1.0.2

    Update to 1.0.2

  • org.jasig.cas:cas-client Maven

    Versions
    • 3.0
    • 3.0-rc1
    • 3.0-rc2
    • 3.1
    • 3.1-M1
    • 3.1-RC1
    • 3.1-RC2
    • 3.1-RC3
    • 3.1.1
    • 3.1.10
    • 3.1.2
    • 3.1.3
    • 3.1.3-rc1
    • 3.1.3-rc2
    • 3.1.3-rc3
    • 3.1.4
    • 3.1.5
    • 3.1.6
    • 3.1.7
    • 3.1.8
    • 3.1.9
    Affected ranges
    • ECOSYSTEM: < 3.3.2

    Update to 3.3.2

  • jasig/phpcas Packagist

    Affected ranges
    • ECOSYSTEM: < 1.3.3

    Update to 1.3.3

Original sources

Check your server →