Description
Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3, when proxy mode is enabled, allow remote attackers to inject arbitrary web script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou) parameter to the callback function in client.php, (2) vectors involving functions that make getCallbackURL calls, or (3) vectors involving functions that make getURL calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moodle | 1.8.13-3 | DSA-2172-1 |
Advisories 1
- DSA-2172-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
- DSA-2172 vendor-advisory
- https://issues.jasig.org/browse/PHPCAS-80
- ADV-2011-0456 vdb-entry
- FEDORA-2010-15943 vendor-advisory
- FEDORA-2010-15970 vendor-advisory
- ADV-2010-2909 vdb-entry
- 43585 vdb-entry
- 42149 third-party-advisory
- https://forge.indepnet.net/projects/glpi/repository/revisions/12601
- ADV-2010-2705 vdb-entry
- 43427 third-party-advisory
- [oss-security] 20100929 CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- FEDORA-2010-16912 vendor-advisory
- https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
- FEDORA-2010-16905 vendor-advisory
- 41878 third-party-advisory
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- 42184 third-party-advisory