Unscored severity · published Jun 6, 2014
CVE-2012-5583
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
–
CVSS
0.6%
EPSS
No
On KEV
Description
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phpcas · Apereo
through 1.3.1; 1.3.0; 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5583
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5583
secunia.com
http://secunia.com/advisories/51818
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/81208
github.com
https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog
More from Phpcas
9.8
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before…
8.1
CVE-2017-1000071
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server
8.0
CVE-2022-39369
Service Hostname Discovery Exploitation in phpCAS
5.5
CVE-2012-1105
An Information Disclosure vulnerability exists in the Jasig Project php-pear-CAS 1.2.2 package in the /tmp directory
5.3
CVE-2012-1104
A Security Bypass vulnerability exists in the phpCAS 1.2.2 library from the jasig project due to the way proxying of services are managed