CVE-2022-39369 — Resource Injection in Phpcas
Severity
8.0HIGHNVD
EPSS
0.9%
top 23.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 1
Latest updateJul 31
Description
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate tickets. This allows an attacker to control the host header and use a valid ticket granted for any authorized service in the same SSO realm (CAS server) to authenticate to the service protected by phpCAS. Depending on the settings of the CAS server service registry in wor…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9
Affected Packages3 packages
Also affects: Fedora 35, 36, 37
🔴Vulnerability Details
4OSV▶
CVE-2022-39369: phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server↗2022-11-01