PT-2018-4196 · Jasig · Jasig Cas Server

Published 2018-07-20 · Updated 2018-09-19 · CVE-2014-2296

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Jasig CAS server versions prior to 3.4.12.1 Jasig CAS server versions 3.5.x prior to 3.5.2.1

Description The issue allows remote unauthenticated users to bypass authentication via crafted XML data when Google Accounts Integration is enabled. This is due to an XML external entity (XXE) vulnerability in the java/org/jasig/cas/util/SamlUtils.java file.

Recommendations For Jasig CAS server versions prior to 3.4.12.1, update to version 3.4.12.1 or later. For Jasig CAS server versions 3.5.x prior to 3.5.2.1, update to version 3.5.2.1 or later. As a temporary workaround, consider disabling Google Accounts Integration until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2014-2296

Affected Products

Jasig Cas Server

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-2296 · Security Note
• http://jasig.275507.n4.nabble.com/CAS-3-5-2-1-and-3-4-12-1-Security-Releases-td4662444.html · Vendor Advisory
• https://vigilance.fr/vulnerability/Jasig-CAS-Server-bypassing-authentication-via-Google-Accounts-Integration-14512 · Note