PT-2024-16824

Name of the Vulnerable Software and Affected Versions Apereo CAS version 6.6 Description A vulnerability has been found in Apereo CAS, affecting an unknown functionality of the file /login. The manipulation of the redirect uri argument leads to open redirect. The attack can be launched remotely...

CVE-2024-11207: URL Redirection to Untrusted Site

A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login. The manipulation of the argument redirecturi leads to open redirect. The attack can be launched remotely. The exploit has been disclosed t...

CVE-2024-11208: Insufficient Session Expiration

A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitati...

Fedora 37 : php-pear-CAS (2022-d6c6782130)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-d6c6782130 advisory. Changes in version 1.6.0 Bug Fixes: Introduce required servicename constructor argument to fix service hostname discovery exploitation vulnerability...

org.jenkins-ci.plugins:cas-plugin (1.7.0), org.jenkins-ci.plugins:parallel-test-executor (500.va_5e1c1f1a_211) potentially affected by CVE-2024-52549 via org.jenkins-ci.plugins:script-security (1358.vb_26663c13537)

org.jenkins-ci.plugins:script-security MAVEN version 1358.vb26663c13537 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:script-security and may be impacted: - org.jenkins-ci.plugins:cas-plugin 1.7.0 -...

org.jasig.cas:cas-server-webapp (3.4-rc1), org.jasig.openregistry:openregistry-repository-jpa-impl (>=0.1-m3.1, <=0.1-m4) +3 more potentially affected by CVE-2023-1932 via org.hibernate:hibernate-validator (4.0.1.ga)

org.hibernate:hibernate-validator MAVEN version 4.0.1.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - org.jasig.cas:cas-server-webapp 3.4-rc1 -...

org.acegisecurity:acegi-security-cas (>=1.0.5, <=1.0.7), org.acegisecurity:acegi-security-samples-contacts (1.0.7) +4 more potentially affected by CVE-2024-38820 via org.springframework:spring-web (1.2.9)

org.springframework:spring-web MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.acegisecurity:acegi-security-cas =1.0.5, =1.0.7 -...

io.github.johnjcool:keycloak-cas-services (4.4.0.final), io.gravitee.resource:gravitee-resource-oauth2-provider-keycloak (1.1.0) +65 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (4.4.0.final)

org.keycloak:keycloak-core MAVEN version 4.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.4.0.final -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), org.keycloak:keycloak-dependencies-server-min (4.5.0.final) +3 more potentially affected by CVE-2024-7341 via org.keycloak:keycloak-services (4.5.0.final)

org.keycloak:keycloak-services MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-dependencies-server-min (4.3.0.final) +3 more potentially affected by CVE-2024-7341 via org.keycloak:keycloak-services (4.3.0.final)

org.keycloak:keycloak-services MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-dependencies-server-min (4.2.0.final) +3 more potentially affected by CVE-2024-7341 via org.keycloak:keycloak-services (4.2.0.final)

org.keycloak:keycloak-services MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2024-7341 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), org.keycloak:keycloak-dependencies-server-min (4.5.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.5.0.final)

org.keycloak:keycloak-services MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final -...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-dependencies-server-min (4.2.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.2.0.final)

org.keycloak:keycloak-services MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-dependencies-server-min (4.3.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.3.0.final)

org.keycloak:keycloak-services MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2024-8883 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

org.pac4j:pac4j-cas (1.9.8), org.pac4j:pac4j-config (1.9.8) +11 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.9.8)

org.pac4j:pac4j-core MAVEN version 1.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.9.8 - org.pac4j:pac4j-config 1.9.8 - org.pac4j:pac4j-gae 1.9.8 - org.pac4j:pac4j-http 1.9.8 -...

org.apereo.cas:cas-server-core (5.3.0-rc4), org.apereo.cas:cas-server-core-api-audit (5.3.0-rc4) +244 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (3.0.0-rc2)

org.pac4j:pac4j-core MAVEN version 3.0.0-rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.apereo.cas:cas-server-core 5.3.0-rc4 - org.apereo.cas:cas-server-core-api-audit 5.3.0-rc4 -...

org.pac4j:pac4j-cas (2.3.0), org.pac4j:pac4j-config (2.3.0) +12 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (2.3.0)

org.pac4j:pac4j-core MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 2.3.0 - org.pac4j:pac4j-config 2.3.0 - org.pac4j:pac4j-couch 2.3.0 - org.pac4j:pac4j-gae 2.3.0 -...

org.pac4j:pac4j-cas (1.8.6), org.pac4j:pac4j-config (1.8.6) +12 more potentially affected by CVE-2023-25581 via org.pac4j:pac4j-core (1.8.6)

org.pac4j:pac4j-core MAVEN version 1.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.8.6 - org.pac4j:pac4j-config 1.8.6 - org.pac4j:pac4j-gae 1.8.6 - org.pac4j:pac4j-http 1.8.6 -...