PT-2017-10778 · Jasig · Jasig Phpcas

Published 2017-07-13 · Updated 2019-10-03 · CVE-2017-1000071

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jasig phpCAS version 1.3.4

Description The issue concerns an authentication bypass in the validateCAS20 function. This occurs when Jasig phpCAS is configured to authenticate against an old CAS server.

Recommendations For Jasig phpCAS version 1.3.4, consider updating the configuration to use a newer CAS server or apply alternative authentication methods to mitigate the risk of authentication bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-1000071

Affected Products

Jasig Phpcas

References · 10

• https://osv.dev/vulnerability/DEBIAN-CVE-2017-1000071 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-1000071 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-1000071 · Security Note
• https://ubuntu.com/security/CVE-2017-1000071 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-1000071 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000071 · Security Note
• https://github.com/Jasig/phpCAS/issues/228 · Note
• https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog · Note
• http://securityfocus.com/bid/99609 · Note