PT-2010-5005 · Jasig · Phpcas

Raphael Geissert

·

Publicado

2010-10-07

·

Atualizado

2019-12-30

·

CVE-2010-3692

CVSS v2.0

6.4

Média

VetorAV:N/AC:L/Au:N/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions phpCAS versions prior to 1.1.3
Description The issue allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a PGTiou parameter when proxy mode is enabled. This is due to a directory traversal vulnerability in the callback function in client.php.
Recommendations For versions prior to 1.1.3, update to version 1.1.3 or later to resolve the issue. As a temporary workaround, consider disabling proxy mode until a patch is available. Restrict access to the client.php file to minimize the risk of exploitation. Avoid using the PGTiou parameter in the affected callback function until the issue is resolved.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2010-3692
DSA-2172-1

Produtos afetados

Phpcas