CVE-2010-1618

phpCAS client library < 1.1.0 - Cross-Site Scripting via Crafted URL

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message.

References (5)

Core 5
Core References
Third Party Advisory x_refsource_confirm
http://www.ja-sig.org/wiki/display/CASC/phpCAS+ChangeLog
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/1107
Various Sources x_refsource_confirm
http://moodle.org/security/
Vendor Advisory x_refsource_confirm
http://www.ja-sig.org/issues/browse/PHPCAS-52

Scores

EPSS 0.0027
EPSS Percentile 50.7%

Details

CWE
CWE-79
Status published
Products (22)
apereo/phpcas 0 - 1.1.0Packagist
ja-sig/phpcas_client_library 1.0.0
ja-sig/phpcas_client_library 1.0.1
moodle/moodle 1.8.1
moodle/moodle 1.8.2
moodle/moodle 1.8.3
moodle/moodle 1.8.4
moodle/moodle 1.8.5
moodle/moodle 1.8.6
moodle/moodle 1.8.7
... and 12 more
Published Apr 29, 2010
Tracked Since Feb 18, 2026