Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

Back to All

CVE

CVE-2014-4172

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

Description

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Base CVSS

9.8

EPSS Score

6.74%

Introduced Version

Fix Available

1.0.2,3.3.2,1.3.3

Fix without Upgrading

Available Patches

Package

CVEs Fixed

Lines of Code Changed

Package Name

org.jasig.cas.client:cas-client-core

References

https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718

https://bugzilla.redhat.com/show_bug.cgi?id=1131350

https://nvd.nist.gov/vuln/detail/CVE-2014-4172

https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814

http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html

https://github.com/apereo/java-cas-client/commit/266eba7c2d870d70caba6f41576d19f2fcc869b1

https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/95673

https://www.debian.org/security/2014/dsa-3017.en.html

https://issues.jasig.org/browse/CASC-228

https://github.com/Jasig/phpCAS/pull/125

https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d

AppSec for the Software Development Revolution

Endor Labs builds a complete graph of your software estate, so teams can pinpoint and fix critical risks in complex, dependency-rich code—whether it was written by humans or AI.

Welcome to the resistance

Oops! Something went wrong, please try again.