CVE-2012-5583 — Phpcas vulnerability

CWE-3104 documents4 sources
Severity
5.8MEDIUMNVD
EPSS
0.2%
top 64.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Debian Php-casApereo Phpcas
Timeline
PublishedJun 6
Latest updateMay 13

Description

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages2 packages

▶NVDapereo/phpcas1.3.1+1
▶debiandebian/php-cas< php-cas 1.3.1-2 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-qwv4-3pjq-hx89: phpCAS before 1↗2022-05-13
▶
OSV
CVE-2012-5583: phpCAS before 1↗2014-06-06
▶

📋Vendor Advisories

1
Debian
CVE-2012-5583: php-cas - phpCAS before 1.3.2 does not verify that the server hostname matches a domain na...↗2012
▶
CVE-2012-5583 — Apereo Phpcas vulnerability | cvebase