Vulnerability Description
phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value.
CVSS Score
4.0
MEDIUM
AV:N/AC:L/Au:S/C:N/I:P/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joachim Fritschi | Phpcas | <= 1.1.1 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.h
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.h
- http://secunia.com/advisories/40845Vendor Advisory
- http://secunia.com/advisories/41240
- http://secunia.com/advisories/42149
- http://secunia.com/advisories/42184
- http://secunia.com/advisories/43427
- http://www.debian.org/security/2011/dsa-2172
- http://www.securityfocus.com/bid/42162
- http://www.vupen.com/english/advisories/2010/2234
- http://www.vupen.com/english/advisories/2010/2261
- http://www.vupen.com/english/advisories/2010/2909
- http://www.vupen.com/english/advisories/2011/0456
FAQ
What is CVE-2010-2795?
CVE-2010-2795 is a vulnerability with a CVSS score of 4.0 (MEDIUM). phpCAS before 1.1.2 allows remote authenticated users to hijack sessions via a query string containing a crafted ticket value.
How severe is CVE-2010-2795?
CVE-2010-2795 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-2795?
Check the references section above for vendor advisories and patch information. Affected products include: Joachim Fritschi Phpcas.