{"action":"Upgrade jasig/phpcas to 1.3.3 or later.","affected":[{"fixed":"1.3.3","introduced":"0"}],"component":"jasig/phpcas","cve_ids":["CVE-2014-4172"],"ecosystem":"Packagist","epss":0.06057,"exploited":false,"fixed_versions":["1.3.3"],"ghsa_id":"GHSA-9fc5-q25c-r2wr","id":"tcs_01M5KEZZZD5V26W9S03HSGKW4G","modified_at":"2024-04-12T22:01:27.708442Z","published_at":"2022-05-17T19:57:18Z","references":["https://osv.dev/vulnerability/GHSA-9fc5-q25c-r2wr","https://nvd.nist.gov/vuln/detail/CVE-2014-4172","https://github.com/Jasig/phpCAS/pull/125","https://github.com/Jasig/dotnet-cas-client/commit/f0e030014fb7a39e5f38469f43199dc590fd0e8d","https://github.com/Jasig/java-cas-client/commit/ae37092100c8eaec610dab6d83e5e05a8ee58814","https://github.com/apereo/java-cas-client/commit/266eba7c2d870d70caba6f41576d19f2fcc869b1","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=759718","https://bugzilla.redhat.com/show_bug.cgi?id=1131350","https://exchange.xforce.ibmcloud.com/vulnerabilities/95673","https://github.com/Jasig/phpCAS/blob/master/docs/ChangeLog","https://issues.jasig.org/browse/CASC-228","https://www.debian.org/security/2014/dsa-3017.en.html","https://www.mail-archive.com/cas-user@lists.jasig.org/msg17338.html","http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137182.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9fc5-q25c-r2wr","url":"https://osv.dev/vulnerability/GHSA-9fc5-q25c-r2wr"}],"summary":"Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability"}