CVE-2012-5583: phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…

PriorityP424medium5.8CVSS 2.0

AVNACMAuNCPIPAN

EPSS

0.58%

44.1th percentile

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
apereo	phpcas	<= 1.3.1	—
apereo	phpcas	—	—
debian	php-cas	< php-cas 1.3.1-2 (bookworm)	php-cas 1.3.1-2 (bookworm)

CVSS provenance

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

osv5.8MEDIUM

vendor_debian5.8MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.