Unscored severity · published Oct 7, 2010
CVE-2010-3691
PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file
–
CVSS
0.4%
EPSS
No
On KEV
Description
PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpcas · Apereo
through 1.1.2; 0.2; 0.3; 0.3.1; 0.3.2; 0.4; +24 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3691
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3691
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html
secunia.com
http://secunia.com/advisories/41878
More from Phpcas
9.8
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before…
8.1
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server
8.0
CVE-2022-39369
Service Hostname Discovery Exploitation in phpCAS
5.5
CVE-2012-1105
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory
5.3
CVE-2012-1104
A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed