Critical severity · published Jan 24, 2020
CVE-2014-4172
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before…
9.8
CVSS
6.1%
EPSS
No
On KEV
Description
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NC
.net Cas Client · Apereo
before 1.0.2 · source: NVD
DL
Debian Linux · Debian
7.0 · source: NVD
FE
Fedora · Fedoraproject
20 · source: NVD
JC
Java Cas Client · Apereo
before 3.3.2 · source: NVD
PH
Phpcas · Apereo
before 1.3.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-4172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-4172
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1131350
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95673
Patch
https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d
Patch
https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814