OCS Inventory vulnerability

2024-07-2400:00:00

ubuntu.com

ocs inventory

ubuntu 22.04 lts

phpcas

http headers

remote attacker

account access

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

60.9%

JSON

Releases

Ubuntu 22.04 LTS

Packages

ocsinventory-server - Hardware and software inventory tool

Details

Filip Hejsek discovered that the phpCAS library included in OCS Inventory
was using HTTP headers to determine the service URL used to validate
tickets. A remote attacker could possibly use this issue to gain access
to a victim’s account.

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchocsinventory-reports< 2.8.1+dfsg1-1ubuntu0.1UNKNOWN
Ubuntu22.04noarchocsinventory-server< 2.8.1+dfsg1-1ubuntu0.1UNKNOWN