CVE-2010-3690

2010-10-0700:00:00

ubuntu.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

72.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in phpCAS before 1.1.3,
when proxy mode is enabled, allow remote attackers to inject arbitrary web
script or HTML via (1) a crafted Proxy Granting Ticket IOU (PGTiou)
parameter to the callback function in client.php, (2) vectors involving
functions that make getCallbackURL calls, or (3) vectors involving
functions that make getURL calls.