Every CVE Search/ Get API key

CVE-2014-4172

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

9.8 CriticalFix available

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

6.06%Up 3.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
CVE-2014-4172
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-74
Updated
2026-11-02
CVE List No score

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
CVE-2014-4172
Updated
2026-11-02
EUVDEUVD-2022-3362 No score

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
EUVD-2022-3362
Updated
2026-11-03
GitHub AdvisoriesGHSA-9fc5-q25c-r2wr 9.8

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
GHSA-9fc5-q25c-r2wr
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSV 9.8

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
CVE-2014-4172
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2014-4172 9.8

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
DEBIAN-CVE-2014-4172
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-9fc5-q25c-r2wr 9.8

Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
GHSA-9fc5-q25c-r2wr
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-74
Updated
2026-11-02
OSVUBUNTU-CVE-2014-4172 9.8

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Record
UBUNTU-CVE-2014-4172
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2014-0387 No score

Updated php-pear-CAS packages fix CVE-2014-4172

Updated php-pear-CAS packages fix security vulnerabilities:

A flaw in php-pear-CAS before 1.3.3, utilized by Moodle, has been found which could potentially allow unauthorised access and privilege escalation (CVE-2014-4172).

Record
MGASA-2014-0387
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
DotNetCasClient
NuGet
 before 1.0.2
1.0.2
org.jasig.cas:cas-client
Maven
 before 3.3.2
3.3.2
jasig/phpcas
Packagist
 before 1.3.3
1.3.3
php-cas
Debian:12
 before 1.3.3-1
1.3.3-1
php-cas
Debian:13
 before 1.3.3-1
1.3.3-1
php-cas
Debian:14
 before 1.3.3-1
1.3.3-1
php-cas
Debian:7
 before 1.3.1-4+deb7u1, plus listed versions
1.3.1-4
1.3.1-4+deb7u1
DotNetCasClient
NuGet
 before 1.0.2, plus listed versions
1.0.01.0.1
1.0.2
org.jasig.cas:cas-client
Maven
 before 3.3.2, plus listed versions
3.03.0-rc13.0-rc23.13.1-M1
Show 16 moreShow less
3.1-RC13.1-RC23.1-RC33.1.13.1.103.1.23.1.33.1.3-rc13.1.3-rc23.1.3-rc33.1.43.1.53.1.63.1.73.1.83.1.9
3.3.2
php-pear-CAS
Mageia:3
 before 1.3.3-1.mga3
1.3.3-1.mga3
php-pear-CAS
Mageia:4
 before 1.3.3-1.mga4
1.3.3-1.mga4

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-4172 is a critical vulnerability (CVSS 9.8) in Apereo .net Cas Client, published September 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.06%, the 93rd percentile. Fixed in DotNetCasClient 1.0.2.

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open