peter bassill · operator
$ cve CVE-2014-4172 JSON

CVE-2014-4172

9.8
CRITICAL · CVSS 3.1 · EPSS 6.1% (pctl 93)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS6.06% — more likely to be exploited than 93% of all CVEs
WeaknessCWE-74
On CISA KEVno
Public exploitnone known
Published2020-01-24
Last modified2026-06-17

Affected (5)

VendorProduct
apereo.net cas client
apereojava cas client
apereophpcas
debiandebian linux
fedoraprojectfedora

References

→ the Explorer  ·  watch your stack  ·  NVD