Skip to content
OpenAdvisories
High USN-6914-1 1 CVE

ocsinventory-server vulnerability

Published Jul 24, 2024 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Filip Hejsek discovered that the phpCAS library included in OCS Inventory
was using HTTP headers to determine the service URL used to validate
tickets. A remote attacker could possibly use this issue to gain access
to a victim's account.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS ocsinventory-server 2.8.1+dfsg1-1ubuntu0.1

Vulnerabilities 1

  • High 8.0
    CVE-2022-39369

    Service Hostname Discovery Exploitation in phpCAS

    phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacke…

    Apereo phpCAS moodle ocsinventory-server Debian Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2022-39369