A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS
    protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that
    allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to
    validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to
    validation/Cas20ServiceTicketValidator.java. (CVE-2014-4172)

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.5.x prior to 2.5.8, 2.6.x prior to 2.6.5, 2.7.x prior to 2.7.2, and all previous releases are exposed to the following vulnerabilities :

  - A security bypass vulnerability affects the third-party library utilized by Moodle, phpCAS. Specifically, this is a flaw related to improper URL encoding in the back-channel ticket validation. With a specially crafted request, a remote attacker can bypass intended security constraints. (MSA-14-0033 / CVE-2014-4172)

  - An information disclosure vulnerability affects the Q&A forum. Specifically, this affects the script '/mod/forum/view.php' by allowing users who had not yet posted the required answer to see the name of the last person who had posted their answer. (MSA-14-0034 / CVE-2014-3617)

Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting.

- update to 3.3.3

    - fix CVE-2014-4172 (rhbz#1131371)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
413241	SCA: security update for DotNetCasClient, jasig/phpcas, org.jasig.cas:cas-client (GHSA-9fc5-q25c-r2wr)	Tenable Cloud Security	SCA Checks	critical
413241	SCA: security update for DotNetCasClient, jasig/phpcas, org.jasig.cas:cas-client (GHSA-9fc5-q25c-r2wr)	Tenable Self-Hosted Container Security	SCA Checks	critical
8719	Moodle < 2.5 / 2.5.x < 2.5.8 / 2.6.x < 2.6.5 / 2.7.x < 2.7.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
77510	Debian DSA-3017-1 : php-cas - security update	Nessus	Debian Local Security Checks	critical
77449	Fedora 20 : cas-client-3.3.3-1.fc20 (2014-9662)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-4172

critical

Tenable Plugins

critical

critical

medium

critical

medium