CVE-2010-2796

Published: Aug 5, 2010Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL.

Affected (35)

Products: Joachim Fritschi: Phpcas

Joachim Fritschi

1 product

Configuration A

35 vulnerable

Vulnerable Software	Affected Versions
Joachim Fritschi Phpcas	Up to 1.1.1
Joachim Fritschi Phpcas	Version 0.2
Joachim Fritschi Phpcas	Version 0.3.1
Joachim Fritschi Phpcas	Version 0.3.2
Joachim Fritschi Phpcas	Version 0.3
Joachim Fritschi Phpcas	Version 0.4.10
Joachim Fritschi Phpcas	Version 0.4.11
Joachim Fritschi Phpcas	Version 0.4.12
Joachim Fritschi Phpcas	Version 0.4.13
Joachim Fritschi Phpcas	Version 0.4.14
Joachim Fritschi Phpcas	Version 0.4.15
Joachim Fritschi Phpcas	Version 0.4.16
Joachim Fritschi Phpcas	Version 0.4.17
Joachim Fritschi Phpcas	Version 0.4.18
Joachim Fritschi Phpcas	Version 0.4.19
Joachim Fritschi Phpcas	Version 0.4.1
Joachim Fritschi Phpcas	Version 0.4.20
Joachim Fritschi Phpcas	Version 0.4.21
Joachim Fritschi Phpcas	Version 0.4.22
Joachim Fritschi Phpcas	Version 0.4.23
Joachim Fritschi Phpcas	Version 0.4.2
Joachim Fritschi Phpcas	Version 0.4.3
Joachim Fritschi Phpcas	Version 0.4.4
Joachim Fritschi Phpcas	Version 0.4.5
Joachim Fritschi Phpcas	Version 0.4.6
Joachim Fritschi Phpcas	Version 0.4.7
Joachim Fritschi Phpcas	Version 0.4.8
Joachim Fritschi Phpcas	Version 0.4.9
Joachim Fritschi Phpcas	Version 0.4
Joachim Fritschi Phpcas	Version 0.5.0
Joachim Fritschi Phpcas	Version 0.5.1
Joachim Fritschi Phpcas	Version 0.6.0
Joachim Fritschi Phpcas	Version 1.0.0
Joachim Fritschi Phpcas	Version 1.0.1
Joachim Fritschi Phpcas	Version 1.1.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (38)

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: secalert@redhat.com

http://secunia.com/advisories/40845

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/41240

Source: secalert@redhat.com

http://secunia.com/advisories/42149

Source: secalert@redhat.com

http://secunia.com/advisories/42184

Source: secalert@redhat.com

http://secunia.com/advisories/43427

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2172

Source: secalert@redhat.com

http://www.securityfocus.com/bid/42160

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2234

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2261

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2909

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0456

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/60895

Source: secalert@redhat.com

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: secalert@redhat.com

https://issues.jasig.org/browse/PHPCAS-67

Source: secalert@redhat.com

https://wiki.jasig.org/display/CASC/phpCAS+ChangeLog

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/40845

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/41240

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42149

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42184

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43427

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2172

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/42160

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2234

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2261

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2909

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0456

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/60895

Source: af854a3a-2127-422b-91ae-364da2661108

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.jasig.org/browse/PHPCAS-67

Source: af854a3a-2127-422b-91ae-364da2661108

https://wiki.jasig.org/display/CASC/phpCAS+ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.