Vulnerabilities > Apereo > Phpcas

DATE CVE VULNERABILITY TITLE RISK
2022-11-01 CVE-2022-39369 phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server.
network
low complexity
apereo fedoraproject
8.0
2020-01-24 CVE-2014-4172 Injection vulnerability in multiple products
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
network
low complexity
apereo debian fedoraproject CWE-74
critical
9.8
2019-12-05 CVE-2012-1105 Information Exposure vulnerability in multiple products
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory.
local
low complexity
apereo fedoraproject debian CWE-200
5.5
2019-12-05 CVE-2012-1104 Improper Privilege Management vulnerability in multiple products
A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed.
network
low complexity
apereo debian CWE-269
5.3
2017-07-17 CVE-2017-1000071 Improper Authentication vulnerability in Apereo PHPcas 1.3.4
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
network
high complexity
apereo CWE-287
8.1