URL Parameter Injection Vulnerability in Jasig Java CAS Client and .NET CAS Client
CVE-2014-4172

9.8CRITICAL

Key Information:

Vendor

Apereo

Status
.net Cas Client
Java Cas Client
PHPcas
Vendor
CVE Published:
24 January 2020

What is CVE-2014-4172?

A URL parameter injection vulnerability exists in the back-channel ticket validation process of the CAS protocol. This flaw can be exploited by remote attackers to inject arbitrary web scripts or HTML, compromising web application security. The issue affects various versions of the Jasig Java CAS Client, .NET CAS Client, and phpCAS prior to their respective patched versions. Such vulnerabilities pose significant risks, enabling attackers to manipulate service parameters and jeopardize the integrity of the authentication process.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1131350
x_refsource_MISC
https://www.mail-archive.com/cas-user%40lists.jasig.org/m...
x_refsource_MISC
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.