CVE-2010-2795

Published: Aug 5, 2010Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value.

Affected (35)

Products: Joachim Fritschi: Phpcas

Joachim Fritschi

1 product

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Joachim Fritschi Phpcas	Up to 1.1.1
Joachim Fritschi Phpcas	Version 0.2
Joachim Fritschi Phpcas	Version 0.3.1
Joachim Fritschi Phpcas	Version 0.3.2
Joachim Fritschi Phpcas	Version 0.3
Joachim Fritschi Phpcas	Version 0.4.10
Joachim Fritschi Phpcas	Version 0.4.11
Joachim Fritschi Phpcas	Version 0.4.12
Joachim Fritschi Phpcas	Version 0.4.13
Joachim Fritschi Phpcas	Version 0.4.14
Joachim Fritschi Phpcas	Version 0.4.15
Joachim Fritschi Phpcas	Version 0.4.16
Joachim Fritschi Phpcas	Version 0.4.17
Joachim Fritschi Phpcas	Version 0.4.18
Joachim Fritschi Phpcas	Version 0.4.19
Joachim Fritschi Phpcas	Version 0.4.1
Joachim Fritschi Phpcas	Version 0.4.20
Joachim Fritschi Phpcas	Version 0.4.21
Joachim Fritschi Phpcas	Version 0.4.22
Joachim Fritschi Phpcas	Version 0.4.23
Joachim Fritschi Phpcas	Version 0.4.2
Joachim Fritschi Phpcas	Version 0.4.3
Joachim Fritschi Phpcas	Version 0.4.4
Joachim Fritschi Phpcas	Version 0.4.5
Joachim Fritschi Phpcas	Version 0.4.6
Joachim Fritschi Phpcas	Version 0.4.7
Joachim Fritschi Phpcas	Version 0.4.8
Joachim Fritschi Phpcas	Version 0.4.9
Joachim Fritschi Phpcas	Version 0.4
Joachim Fritschi Phpcas	Version 0.5.0
Joachim Fritschi Phpcas	Version 0.5.1
Joachim Fritschi Phpcas	Version 0.6.0
Joachim Fritschi Phpcas	Version 1.0.0
Joachim Fritschi Phpcas	Version 1.0.1
Joachim Fritschi Phpcas	Version 1.1.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (38)

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: secalert@redhat.com

http://secunia.com/advisories/40845

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/41240

Source: secalert@redhat.com

http://secunia.com/advisories/42149

Source: secalert@redhat.com

http://secunia.com/advisories/42184

Source: secalert@redhat.com

http://secunia.com/advisories/43427

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2172

Source: secalert@redhat.com

http://www.securityfocus.com/bid/42162

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2234

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2261

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2909

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0456

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/60894

Source: secalert@redhat.com

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: secalert@redhat.com

https://issues.jasig.org/browse/PHPCAS-61

Source: secalert@redhat.com

Patch

https://wiki.jasig.org/display/CASC/phpCAS+ChangeLog

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40845

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/41240

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42149

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42184

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43427

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2172

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/42162

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2234

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2261

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2909

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0456

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/60894

Source: af854a3a-2127-422b-91ae-364da2661108

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.jasig.org/browse/PHPCAS-61

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://wiki.jasig.org/display/CASC/phpCAS+ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.