PT-2017-10778 · Jasig · Jasig Phpcas

Publicado 2017-07-13 · Atualizado 2019-10-03 · CVE-2017-1000071

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jasig phpCAS version 1.3.4

Description The issue concerns an authentication bypass in the validateCAS20 function. This occurs when Jasig phpCAS is configured to authenticate against an old CAS server.

Recommendations For Jasig phpCAS version 1.3.4, consider updating the configuration to use a newer CAS server or apply alternative authentication methods to mitigate the risk of authentication bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-1000071

Produtos afetados

Jasig Phpcas

Referências · 10

• https://github.com/Jasig/phpCAS/issues/228 · Nota
• https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000071 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-1000071 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-1000071 · Nota de Segurança
• https://ubuntu.com/security/CVE-2017-1000071 · Aviso do Fabricante
• http://securityfocus.com/bid/99609 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000071 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000071 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000071 · Nota de Segurança