CVE-2010-3692
Summary
| CVE | CVE-2010-3692 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-10-07 21:00:00 UTC |
| Updated | 2019-12-30 12:59:00 UTC |
| Description | Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apereo | Phpcas | 0.2 | All | All | All |
| Application | Apereo | Phpcas | 0.3 | All | All | All |
| Application | Apereo | Phpcas | 0.3.1 | All | All | All |
| Application | Apereo | Phpcas | 0.3.2 | All | All | All |
| Application | Apereo | Phpcas | 0.4 | All | All | All |
| Application | Apereo | Phpcas | 0.4.1 | All | All | All |
| Application | Apereo | Phpcas | 0.4.10 | All | All | All |
| Application | Apereo | Phpcas | 0.4.11 | All | All | All |
| Application | Apereo | Phpcas | 0.4.12 | All | All | All |
| Application | Apereo | Phpcas | 0.4.13 | All | All | All |
| Application | Apereo | Phpcas | 0.4.14 | All | All | All |
| Application | Apereo | Phpcas | 0.4.15 | All | All | All |
| Application | Apereo | Phpcas | 0.4.16 | All | All | All |
| Application | Apereo | Phpcas | 0.4.17 | All | All | All |
| Application | Apereo | Phpcas | 0.4.18 | All | All | All |
| Application | Apereo | Phpcas | 0.4.19 | All | All | All |
| Application | Apereo | Phpcas | 0.4.20 | All | All | All |
| Application | Apereo | Phpcas | 0.4.21 | All | All | All |
| Application | Apereo | Phpcas | 0.4.22 | All | All | All |
| Application | Apereo | Phpcas | 0.4.23 | All | All | All |
| Application | Apereo | Phpcas | 0.4.8 | All | All | All |
| Application | Apereo | Phpcas | 0.4.9 | All | All | All |
| Application | Apereo | Phpcas | 0.5.0 | All | All | All |
| Application | Apereo | Phpcas | 0.5.1 | All | All | All |
| Application | Apereo | Phpcas | 0.6.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.1 | All | All | All |
| Application | Apereo | Phpcas | 1.1.0 | All | All | All |
| Application | Apereo | Phpcas | 1.1.1 | All | All | All |
| Application | Apereo | Phpcas | 0.2 | All | All | All |
| Application | Apereo | Phpcas | 0.3 | All | All | All |
| Application | Apereo | Phpcas | 0.3.1 | All | All | All |
| Application | Apereo | Phpcas | 0.3.2 | All | All | All |
| Application | Apereo | Phpcas | 0.4 | All | All | All |
| Application | Apereo | Phpcas | 0.4.1 | All | All | All |
| Application | Apereo | Phpcas | 0.4.10 | All | All | All |
| Application | Apereo | Phpcas | 0.4.11 | All | All | All |
| Application | Apereo | Phpcas | 0.4.12 | All | All | All |
| Application | Apereo | Phpcas | 0.4.13 | All | All | All |
| Application | Apereo | Phpcas | 0.4.14 | All | All | All |
| Application | Apereo | Phpcas | 0.4.15 | All | All | All |
| Application | Apereo | Phpcas | 0.4.16 | All | All | All |
| Application | Apereo | Phpcas | 0.4.17 | All | All | All |
| Application | Apereo | Phpcas | 0.4.18 | All | All | All |
| Application | Apereo | Phpcas | 0.4.19 | All | All | All |
| Application | Apereo | Phpcas | 0.4.20 | All | All | All |
| Application | Apereo | Phpcas | 0.4.21 | All | All | All |
| Application | Apereo | Phpcas | 0.4.22 | All | All | All |
| Application | Apereo | Phpcas | 0.4.23 | All | All | All |
| Application | Apereo | Phpcas | 0.4.8 | All | All | All |
| Application | Apereo | Phpcas | 0.4.9 | All | All | All |
| Application | Apereo | Phpcas | 0.5.0 | All | All | All |
| Application | Apereo | Phpcas | 0.5.1 | All | All | All |
| Application | Apereo | Phpcas | 0.6.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.0 | All | All | All |
| Application | Apereo | Phpcas | 1.0.1 | All | All | All |
| Application | Apereo | Phpcas | 1.1.0 | All | All | All |
| Application | Apereo | Phpcas | 1.1.1 | All | All | All |
| Application | Apereo | Phpcas | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| [PHPCAS-80] Proxy tickets and writing on disk needs more checks - Jira | CONFIRM | issues.jasig.org | |
| #495542 - ITP: php-cas -- Central Authentication Service client library in php - Debian Bug report logs | CONFIRM | bugs.debian.org | |
| FishEye: changeset 21538 | CONFIRM | developer.jasig.org | |
| forge.indepnet.net/projects/glpi/repository/revisions/12601 | CONFIRM | forge.indepnet.net | |
| phpCAS Proxy Mode Multiple Security Vulnerabilities | BID | www.securityfocus.com | |
| oss-security - CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| Debian -- Security Information -- DSA-2172-1 moodle | DEBIAN | www.debian.org | |
| Fedora update for php-pear-CAS - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| GLPI phpCAS Multiple Vulnerabilities - Secunia.com | SECUNIA | secunia.com | |
| [SECURITY] Fedora 12 Update: glpi-0.72.4-3.svn11497.fc12 | FEDORA | lists.fedoraproject.org | |
| Fedora update for glpi - Secunia.com | SECUNIA | secunia.com | |
| Debian update for moodle - Secunia.com | SECUNIA | secunia.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| oss-security - Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| oss-security - Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback | MLIST | www.openwall.com | |
| [SECURITY] Fedora 13 Update: php-pear-CAS-1.1.3-1.fc13 | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 12 Update: php-pear-CAS-1.1.3-1.fc12 | FEDORA | lists.fedoraproject.org | |
| [SECURITY] Fedora 13 Update: glpi-0.72.4-3.svn11497.fc13 | FEDORA | lists.fedoraproject.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.