PT-2023-22011 · Apereo · Apereo Cas

Name of the Vulnerable Software and Affected Versions: Apereo CAS versions prior to 6.6.6 Description: The issue concerns Apereo CAS, an open source single sign-on solution. It can be configured to use authentication based on client X509 certificates, which can be provided via TLS handshake or a...

org.apereo.cas:cas-management-webapp (5.0.0.rc1), org.apereo.cas:cas-management-webapp-support (5.0.0.rc1) +84 more potentially affected by CVE-2023-34620 via org.hjson:hjson (2.0.1)

org.hjson:hjson MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.hjson:hjson and may be impacted: - org.apereo.cas:cas-management-webapp 5.0.0.rc1 - org.apereo.cas:cas-management-webapp-support 5.0.0.rc1 -...

com.buession.cas:buession-cas-audit (>=2.0.0, <=2.3.2), com.buession.cas:buession-cas-audit-core (>=2.3.0, <=2.3.2) +623 more potentially affected by CVE-2023-34620 via org.hjson:hjson (3.0.0)

org.hjson:hjson MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.hjson:hjson and may be impacted: - com.buession.cas:buession-cas-audit =2.0.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.0.0, =1.1.0, =2.3....

com.buession.cas:buession-cas-audit (>=2.0.0, <=2.3.2), com.buession.cas:buession-cas-audit-core (>=2.3.0, <=2.3.2) +623 more potentially affected by CVE-2023-34620 via org.hjson:hjson (3.0.0)

org.hjson:hjson MAVEN version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.hjson:hjson and may be impacted: - com.buession.cas:buession-cas-audit =2.0.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.0.0, =1.1.0, =2.3....

org.jasig.cas:cas-management-webapp (>=4.0.0-rc1, <=4.0.7), org.jasig.cas:cas-server-webapp (>=3.5.1-rc1, <=3.6.0) potentially affected by CVE-2023-34613 via net.sf.sojo:sojo (1.0.5)

net.sf.sojo:sojo MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.sojo:sojo and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc1, =3.5.1-rc1, =3.6.0 Source cves: CVE-2023-34613 Source advisory:...

org.jasig.cas:cas-management-webapp (>=4.0.0-rc1, <=4.0.7), org.jasig.cas:cas-server-webapp (>=3.5.1-rc1, <=3.6.0) potentially affected by CVE-2023-34613 via net.sf.sojo:sojo (1.0.5)

net.sf.sojo:sojo MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on net.sf.sojo:sojo and may be impacted: - org.jasig.cas:cas-management-webapp =4.0.0-rc1, =3.5.1-rc1, =3.6.0 Source cves: CVE-2023-34613 Source advisory:...

CVE-2023-32682

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

Design/Logic Flaw

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

CVE-2023-32682

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

PYSEC-2023-84

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

CVE-2023-32682

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

CVE-2023-32682 Improper checks for deactivated users during login in synapse

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

CVE-2023-32682

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the...

Synapse has improper checks for deactivated users during login

Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...

GHSA-26C5-PPR8-F33P Synapse has improper checks for deactivated users during login

Impact It may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: JSON Web Tokens are enabled for login via the jwtconfig.enabled configuration setting The local password database is enabled via the...

Session Fixation

CAS Plugin is vulnerable to Session Fixation. The vulnerability exists due to not invalidating the existing session on login which allows an attacker to gain administrator access and perform unauthorized actions...

CVE-2023-2822: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

CVE-2023-20881: CAs for syslog-drain mtls feature can be overwritten | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Description Users on cf may override other users syslog drain credentials if they’re aware of the client certificate used for that syslog drain. This applies even if the drain has zero certs. This would allow the user to override the private key and...

GHSA-HJH8-9GXH-CX4X Jenkins CAS Plugin Session Fixation vulnerability

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login...

Jenkins CAS Plugin Session Fixation vulnerability

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. CAS Plugin 1.6.3 invalidates the existing session on login...