CVE-2010-3691
Summary
| CVE | CVE-2010-3691 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-10-07 21:00:00 UTC |
| Updated | 2019-12-30 12:59:00 UTC |
| Description | PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file. |
Risk And Classification
Problem Types: CWE-59
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apereo | Phpcas | 0.2 | All | All | All |
| Application | Apereo | Phpcas | 0.3 | All | All | All |
| Application | Apereo | Phpcas | 0.3.1 | All | All | All |
| Application | Apereo | Phpcas | 0.3.2 | All | All | All |
| Application | Apereo | Phpcas | 0.4 | All | All | All |
| Application | Apereo | Phpcas | 0.4.1 | All | All | All |
| Application | Apereo | Phpcas | 0.4.10 | All | All | All |
| Application | Apereo | Phpcas | 0.4.11 | All | All | All |
| Application | Apereo | Phpcas | 0.4.12 | All | All | All |
| Application | Apereo | Phpcas | 0.4.13 | All | All | All |
| Application | Apereo | Phpcas | 0.4.14 | All | All | All |
| Application | Apereo | Phpcas | 0.4.15 | All | All | All |
| Application | Apereo | Phpcas | 0.4.16 | All | All | All |
| Application | Apereo | Phpcas | 0.4.17 | All | All | All |
| Application | Apereo | Phpcas | 0.4.18 | All | All | All |
| Application | Apereo | Phpcas | 0.4.19 | All | All | All |
| Application | Apereo | Phpcas | 0.4.20 | All | All | All |
| Application | Apereo | Phpcas | 0.4.21 | All | All | All |
| Application | Apereo | Phpcas | 0.4.22 | All | All | All |
| Application | Apereo | Phpcas | 0.4.23 | All | All | All |
| Application | Apereo | Phpcas | 0.4.8 | All | All | All |
| Application | Apereo | Phpcas | 0.4.9 | All | All | All |
| Application | Apereo | Phpcas | 0.5.0 | All | All | All |
| Application | Apereo | Phpcas | 0.5.1 | All | All | All |
| Application | Apereo | Phpcas | 0.6.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.1 | All | All | All |
| Application | Apereo | Phpcas | 1.1.0 | All | All | All |
| Application | Apereo | Phpcas | 1.1.1 | All | All | All |
| Application | Apereo | Phpcas | 0.2 | All | All | All |
| Application | Apereo | Phpcas | 0.3 | All | All | All |
| Application | Apereo | Phpcas | 0.3.1 | All | All | All |
| Application | Apereo | Phpcas | 0.3.2 | All | All | All |
| Application | Apereo | Phpcas | 0.4 | All | All | All |
| Application | Apereo | Phpcas | 0.4.1 | All | All | All |
| Application | Apereo | Phpcas | 0.4.10 | All | All | All |
| Application | Apereo | Phpcas | 0.4.11 | All | All | All |
| Application | Apereo | Phpcas | 0.4.12 | All | All | All |
| Application | Apereo | Phpcas | 0.4.13 | All | All | All |
| Application | Apereo | Phpcas | 0.4.14 | All | All | All |
| Application | Apereo | Phpcas | 0.4.15 | All | All | All |
| Application | Apereo | Phpcas | 0.4.16 | All | All | All |
| Application | Apereo | Phpcas | 0.4.17 | All | All | All |
| Application | Apereo | Phpcas | 0.4.18 | All | All | All |
| Application | Apereo | Phpcas | 0.4.19 | All | All | All |
| Application | Apereo | Phpcas | 0.4.20 | All | All | All |
| Application | Apereo | Phpcas | 0.4.21 | All | All | All |
| Application | Apereo | Phpcas | 0.4.22 | All | All | All |
| Application | Apereo | Phpcas | 0.4.23 | All | All | All |
| Application | Apereo | Phpcas | 0.4.8 | All | All | All |
| Application | Apereo | Phpcas | 0.4.9 | All | All | All |
| Application | Apereo | Phpcas | 0.5.0 | All | All | All |
| Application | Apereo | Phpcas | 0.5.1 | All | All | All |
| Application | Apereo | Phpcas | 0.6.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.1 | All | All | All |
| Application | Apereo | Phpcas | 1.1.0 | All | All | All |
| Application | Apereo | Phpcas | 1.1.1 | All | All | All |
| Application | Apereo | Phpcas | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [PHPCAS-80] Proxy tickets and writing on disk needs more checks - Jira | CONFIRM | issues.jasig.org | |
| #495542 - ITP: php-cas -- Central Authentication Service client library in php - Debian Bug report logs | CONFIRM | bugs.debian.org | |
| FishEye: changeset 21538 | CONFIRM | developer.jasig.org | |
| forge.indepnet.net/projects/glpi/repository/revisions/12601 | CONFIRM | forge.indepnet.net | |
| phpCAS Proxy Mode Multiple Security Vulnerabilities | BID | www.securityfocus.com | |
| oss-security - CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| Debian -- Security Information -- DSA-2172-1 moodle | DEBIAN | www.debian.org | |
| Fedora update for php-pear-CAS - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| GLPI phpCAS Multiple Vulnerabilities - Secunia.com | SECUNIA | secunia.com | |
| [SECURITY] Fedora 12 Update: glpi-0.72.4-3.svn11497.fc12 | FEDORA | lists.fedoraproject.org | |
| Fedora update for glpi - Secunia.com | SECUNIA | secunia.com | |
| Debian update for moodle - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| oss-security - Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| oss-security - Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| [SECURITY] Fedora 13 Update: php-pear-CAS-1.1.3-1.fc13 | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 12 Update: php-pear-CAS-1.1.3-1.fc12 | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 13 Update: glpi-0.72.4-3.svn11497.fc13 | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.