Candidate: CVE-2014-4172
PublicDate: 2020-01-24 19:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4172
 https://github.com/Jasig/phpCAS/pull/125
Description:
 A URL parameter injection vulnerability was found in the back-channel
 ticket validation step of the CAS protocol in Jasig Java CAS Client before
 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow
 remote attackers to inject arbitrary web script or HTML via the (1) service
 parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl
 parameter to validation/Cas20ServiceTicketValidator.java.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_php-cas:
upstream_php-cas: needs-triage
lucid_php-cas: DNE
precise_php-cas: DNE
precise/esm_php-cas: DNE
trusty_php-cas: ignored (reached end-of-life)
trusty/esm_php-cas: DNE (trusty was needed)
utopic_php-cas: ignored (reached end-of-life)
vivid_php-cas: ignored (reached end-of-life)
vivid/stable-phone-overlay_php-cas: DNE
vivid/ubuntu-core_php-cas: DNE
wily_php-cas: ignored (reached end-of-life)
xenial_php-cas: not-affected (1.3.3-1)
yakkety_php-cas: ignored (reached end-of-life)
zesty_php-cas: ignored (reached end-of-life)
artful_php-cas: ignored (reached end-of-life)
bionic_php-cas: not-affected (1.3.3-1)
cosmic_php-cas: not-affected (1.3.3-1)
disco_php-cas: not-affected (1.3.3-1)
devel_php-cas: not-affected (1.3.3-1)