A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)     (CVE-2017-17485)

  - A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS     protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that     allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to     validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to     validation/Cas20ServiceTicketValidator.java. (CVE-2014-4172)

  - An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the     value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to     'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do     not have a sub-element to declare explicit data binding property mappings. (CVE-2017-4971)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.5.x prior to 2.5.8, 2.6.x prior to 2.6.5, 2.7.x prior to 2.7.2, and all previous releases are exposed to the following vulnerabilities :

  - A security bypass vulnerability affects the third-party library utilized by Moodle, phpCAS. Specifically, this is a flaw related to improper URL encoding in the back-channel ticket validation. With a specially crafted request, a remote attacker can bypass intended security constraints. (MSA-14-0033 / CVE-2014-4172)

  - An information disclosure vulnerability affects the Q&A forum. Specifically, this affects the script '/mod/forum/view.php' by allowing users who had not yet posted the required answer to see the name of the last person who had posted their answer. (MSA-14-0034 / CVE-2014-3617)

Marvin S. Addison discovered that Jasig phpCAS, a PHP library for the CAS authentication protocol, did not encode tickets before adding them to an URL, creating a possibility for cross site scripting.

- update to 3.3.3

    - fix CVE-2014-4172 (rhbz#1131371)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
198594	RHEL 7 : jasperreports-server-pro (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
8719	Moodle < 2.5 / 2.5.x < 2.5.8 / 2.6.x < 2.6.5 / 2.7.x < 2.7.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
77510	Debian DSA-3017-1 : php-cas - security update	Nessus	Debian Local Security Checks	critical
77449	Fedora 20 : cas-client-3.3.3-1.fc20 (2014-9662)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-4172

critical

Tenable Plugins

critical

medium

critical

medium