Vulnerability Bulletins |
MSA-17-0016: Authentication bypass vulnerability with old CAS servers |
|
| Affected software | PHP |
|
by Marina Glancy. Old CAS servers (3.3.5.1 or 3.4.2.1, both released Jul 21, 2010) do not escape the failure message which could be exploited with the phpCAS client library that is shipped as part of Moodle. Only fix for this issue was picked to phpCAS library in Moodle, the library will be upgraded to the latest version in the next major Moodle release. See also https://github.com/Jasig/phpCAS/issues/228Severity/Risk:MinorVersions affected:3.3, 3.2 to 3.2.3, 3.1 to 3.1.6 and earlier More info: https://moodle.org/mod/forum/discuss.php?d=355557&parent=1434237 |
|