ByteOS Network

Vulnerability Details :

CVE-2014-4172

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-24 Jan, 2020 | 18:29

Updated At-06 Aug, 2024 | 11:04

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:24 Jan, 2020 | 18:29

Updated At:06 Aug, 2024 | 11:04

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1131350	x_refsource_MISC
https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html	x_refsource_MISC
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718	x_refsource_MISC
https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d	x_refsource_MISC
https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814	x_refsource_MISC
https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog	x_refsource_MISC
https://github.com/Jasig/phpCAS/pull/125	x_refsource_MISC
https://issues.jasig.org/browse/CASC-228	x_refsource_MISC
https://www.debian.org/security/2014/dsa-3017.en.html	x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html	x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/95673	x_refsource_MISC

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1131350

Resource:

x_refsource_MISC

Hyperlink: https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html

Resource:

x_refsource_MISC

Hyperlink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718

Resource:

x_refsource_MISC

Hyperlink: https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d

Resource:

x_refsource_MISC

Hyperlink: https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814

Resource:

x_refsource_MISC

Hyperlink: https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog

Resource:

x_refsource_MISC

Hyperlink: https://github.com/Jasig/phpCAS/pull/125

Resource:

x_refsource_MISC

Hyperlink: https://issues.jasig.org/browse/CASC-228

Resource:

x_refsource_MISC

Hyperlink: https://www.debian.org/security/2014/dsa-3017.en.html

Resource:

x_refsource_MISC

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html

Resource:

x_refsource_MISC

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/95673

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1131350	x_refsource_MISC x_transferred
https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html	x_refsource_MISC x_transferred
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718	x_refsource_MISC x_transferred
https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d	x_refsource_MISC x_transferred
https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814	x_refsource_MISC x_transferred
https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog	x_refsource_MISC x_transferred
https://github.com/Jasig/phpCAS/pull/125	x_refsource_MISC x_transferred
https://issues.jasig.org/browse/CASC-228	x_refsource_MISC x_transferred
https://www.debian.org/security/2014/dsa-3017.en.html	x_refsource_MISC x_transferred
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html	x_refsource_MISC x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/95673	x_refsource_MISC x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1131350

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/Jasig/phpCAS/pull/125

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://issues.jasig.org/browse/CASC-228

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.debian.org/security/2014/dsa-3017.en.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/95673

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:24 Jan, 2020 | 19:15

Updated At:07 Nov, 2023 | 02:20

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

apereo>>.net_cas_client>>Versions before 1.0.2(exclusive)

cpe:2.3:a:apereo:.net_cas_client:*:*:*:*:*:*:*:*

apereo>>java_cas_client>>Versions before 3.3.2(exclusive)

cpe:2.3:a:apereo:java_cas_client:*:*:*:*:*:*:*:*

apereo>>phpcas>>Versions before 1.3.3(exclusive)

cpe:2.3:a:apereo:phpcas:*:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>7.0

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Fedora Project

>>fedora>>20

cpe:2.3:o:fedoraproject:fedora:20:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-74	Primary	nvd@nist.gov

CWE ID: CWE-74

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html	cve@mitre.org	Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718	cve@mitre.org	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1131350	cve@mitre.org	Issue Tracking Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95673	cve@mitre.org	Third Party Advisory VDB Entry
https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d	cve@mitre.org	Patch Third Party Advisory
https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814	cve@mitre.org	Patch Third Party Advisory
https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog	cve@mitre.org	Release Notes Third Party Advisory
https://github.com/Jasig/phpCAS/pull/125	cve@mitre.org	Third Party Advisory
https://issues.jasig.org/browse/CASC-228	cve@mitre.org	Third Party Advisory
https://www.debian.org/security/2014/dsa-3017.en.html	cve@mitre.org	Third Party Advisory
https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html	cve@mitre.org	N/A

Hyperlink: http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=1131350

Source: cve@mitre.org

Resource:

Issue Tracking

Third Party Advisory

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/95673

Source: cve@mitre.org

Resource:

Third Party Advisory

VDB Entry

Hyperlink: https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog

Source: cve@mitre.org

Resource:

Release Notes

Third Party Advisory

Hyperlink: https://github.com/Jasig/phpCAS/pull/125

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://issues.jasig.org/browse/CASC-228

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.debian.org/security/2014/dsa-3017.en.html

Source: cve@mitre.org

Resource:

Third Party Advisory

Hyperlink: https://www.mail-archive.com/cas-user%40lists.jasig.org/msg17338.html

Source: cve@mitre.org

Resource: N/A

CVE-2014-4172

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs