CVE-2010-3690

Published: Oct 7, 2010Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls.

Affected (30)

Products: Apereo: Phpcas

1 product

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Apereo Phpcas	Up to 1.1.2
Apereo Phpcas	Version 0.2
Apereo Phpcas	Version 0.3.1
Apereo Phpcas	Version 0.3.2
Apereo Phpcas	Version 0.3
Apereo Phpcas	Version 0.4.10
Apereo Phpcas	Version 0.4.11
Apereo Phpcas	Version 0.4.12
Apereo Phpcas	Version 0.4.13
Apereo Phpcas	Version 0.4.14
Apereo Phpcas	Version 0.4.15
Apereo Phpcas	Version 0.4.16
Apereo Phpcas	Version 0.4.17
Apereo Phpcas	Version 0.4.18
Apereo Phpcas	Version 0.4.19
Apereo Phpcas	Version 0.4.1
Apereo Phpcas	Version 0.4.20
Apereo Phpcas	Version 0.4.21
Apereo Phpcas	Version 0.4.22
Apereo Phpcas	Version 0.4.23
Apereo Phpcas	Version 0.4.8
Apereo Phpcas	Version 0.4.9
Apereo Phpcas	Version 0.4
Apereo Phpcas	Version 0.5.0
Apereo Phpcas	Version 0.5.1
Apereo Phpcas	Version 0.6.0
Apereo Phpcas	Version 1.0.0
Apereo Phpcas	Version 1.0.1
Apereo Phpcas	Version 1.1.0
Apereo Phpcas	Version 1.1.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (40)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html

Source: secalert@redhat.com

http://secunia.com/advisories/41878

Source: secalert@redhat.com

http://secunia.com/advisories/42149

Source: secalert@redhat.com

http://secunia.com/advisories/42184

Source: secalert@redhat.com

http://secunia.com/advisories/43427

Source: secalert@redhat.com

http://www.debian.org/security/2011/dsa-2172

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/09/29/6

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/10/01/2

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2010/10/01/5

Source: secalert@redhat.com

http://www.securityfocus.com/bid/43585

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2705

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2010/2909

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2011/0456

Source: secalert@redhat.com

https://developer.jasig.org/source/changelog/jasigsvn?cs=21538

Source: secalert@redhat.com

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: secalert@redhat.com

https://issues.jasig.org/browse/PHPCAS-80

Source: secalert@redhat.com

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049600.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049602.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/41878

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42149

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/42184

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43427

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2011/dsa-2172

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/09/29/6

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/10/01/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2010/10/01/5

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/43585

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2705

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/2909

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2011/0456

Source: af854a3a-2127-422b-91ae-364da2661108

https://developer.jasig.org/source/changelog/jasigsvn?cs=21538

Source: af854a3a-2127-422b-91ae-364da2661108

https://forge.indepnet.net/projects/glpi/repository/revisions/12601

Source: af854a3a-2127-422b-91ae-364da2661108

https://issues.jasig.org/browse/PHPCAS-80

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.