← Back

CVE-2026-1554

nvd nist
Published: Feb 4, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.2
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 1.6 / Impact: 2.5
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.

Affected (2)

Jtenman
1 product
Central Authentication System Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Jtenman
Central Authentication System Server
Before 2.0.3
Central Authentication System Server
From 2.1.0 to 2.1.2

Related CWEs

CWE-91
XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

References (1)

Source: mlhess@drupal.org
Vendor Advisory

Timeline

No history available yet.