Description
Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | moodle | 1.8.13-3 | DSA-2172-1 |
Advisories 1
- DSA-2172-1 moodle - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
- DSA-2172 vendor-advisory
- https://issues.jasig.org/browse/PHPCAS-80
- ADV-2011-0456 vdb-entry
- FEDORA-2010-15943 vendor-advisory
- FEDORA-2010-15970 vendor-advisory
- ADV-2010-2909 vdb-entry
- 43585 vdb-entry
- 42149 third-party-advisory
- https://forge.indepnet.net/projects/glpi/repository/revisions/12601
- ADV-2010-2705 vdb-entry
- 43427 third-party-advisory
- [oss-security] 20100929 CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- FEDORA-2010-16912 vendor-advisory
- https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
- FEDORA-2010-16905 vendor-advisory
- 41878 third-party-advisory
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback mailing-list
- 42184 third-party-advisory