Cross-site scripting (XSS) vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL.

Several vulnerabilities have been discovered in phpCAS, a CAS client library for PHP. The Moodle course management system includes a copy of phpCAS.

Switch to system phpCAS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes * Fix a session hijacking hole CVE-2010-2795 [PHPCAS-61] * callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 [PHPCAS-67] Bug fixes * Fix warnings for SAML responses without attributes [PHPCAS-59] * Fix duplicate SAML debug output [PHPCAS-64] * Providing a new ST/PT/SA during an authenticated session will be ignored and a warning will be issued to the debug log.
[PHPCAS-61] * fix 2 undefinded variable notices in serviceWeb() [PHPCAS-68] * Prevent domxml-php4-to-php5 to be inclueded twice [PHPCAS-48] Improvement * Debuglog now contains phpCAS version information [PHPCAS-62]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security fixes. No longer uses bundled php-pear-CAS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
52056	Debian DSA-2172-1 : moodle - several vulnerabilities	Nessus	Debian Local Security Checks	medium
50499	Fedora 13 : glpi-0.72.4-3.svn11497.fc13 (2010-16912)	Nessus	Fedora Local Security Checks	medium
50498	Fedora 12 : glpi-0.72.4-3.svn11497.fc12 (2010-16905)	Nessus	Fedora Local Security Checks	medium
49073	Fedora 14 : php-pear-CAS-1.1.2-1.fc14 (2010-12320)	Nessus	Fedora Local Security Checks	medium
48930	Fedora 13 : php-pear-CAS-1.1.2-1.fc13 (2010-12258)	Nessus	Fedora Local Security Checks	medium
48929	Fedora 12 : php-pear-CAS-1.1.2-1.fc12 (2010-12247)	Nessus	Fedora Local Security Checks	medium
48418	Fedora 14 : moodle-1.9.9-2.fc14 (2010-13396)	Nessus	Fedora Local Security Checks	medium
48394	Fedora 12 : moodle-1.9.9-2.fc12 (2010-13254)	Nessus	Fedora Local Security Checks	medium
48393	Fedora 13 : moodle-1.9.9-2.fc13 (2010-13250)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-2796

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium