PT-2018-4196 · Jasig · Jasig Cas Server

Publicado 2018-07-20 · Atualizado 2018-09-19 · CVE-2014-2296

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jasig CAS server versions prior to 3.4.12.1 Jasig CAS server versions 3.5.x prior to 3.5.2.1

Description The issue allows remote unauthenticated users to bypass authentication via crafted XML data when Google Accounts Integration is enabled. This is due to an XML external entity (XXE) vulnerability in the java/org/jasig/cas/util/SamlUtils.java file.

Recommendations For Jasig CAS server versions prior to 3.4.12.1, update to version 3.4.12.1 or later. For Jasig CAS server versions 3.5.x prior to 3.5.2.1, update to version 3.5.2.1 or later. As a temporary workaround, consider disabling Google Accounts Integration until a patch is available.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2014-2296

Produtos afetados

Jasig Cas Server

Referências · 3

• https://vigilance.fr/vulnerability/Jasig-CAS-Server-bypassing-authentication-via-Google-Accounts-Integration-14512 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-2296 · Nota de Segurança
• http://jasig.275507.n4.nabble.com/CAS-3-5-2-1-and-3-4-12-1-Security-Releases-td4662444.html · Aviso do Fabricante