Vulnerability Description
Cross-site scripting (XSS) vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL.
CVSS Score
2.6
LOW
AV:N/AC:H/Au:N/C:N/I:P/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joachim Fritschi | Phpcas | <= 1.1.1 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046576.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046584.htm
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050415.h
- http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050428.h
- http://secunia.com/advisories/40845Vendor Advisory
- http://secunia.com/advisories/41240
- http://secunia.com/advisories/42149
- http://secunia.com/advisories/42184
- http://secunia.com/advisories/43427
- http://www.debian.org/security/2011/dsa-2172
- http://www.securityfocus.com/bid/42160
- http://www.vupen.com/english/advisories/2010/2234
- http://www.vupen.com/english/advisories/2010/2261
- http://www.vupen.com/english/advisories/2010/2909
- http://www.vupen.com/english/advisories/2011/0456
FAQ
What is CVE-2010-2796?
CVE-2010-2796 is a vulnerability with a CVSS score of 2.6 (LOW). Cross-site scripting (XSS) vulnerability in phpCAS before 1.1.2, when proxy mode is enabled, allows remote attackers to inject arbitrary web script or HTML via a callback URL.
How severe is CVE-2010-2796?
CVE-2010-2796 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-2796?
Check the references section above for vendor advisories and patch information. Affected products include: Joachim Fritschi Phpcas.