Improper access control in Central Authentication Services (CAS) - CVE-2022-39369

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU72486

Improper access control in Central Authentication Services (CAS) - CVE-2022-39369

Published: February 22, 2023


Vulnerability identifier: #VU72486
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-39369
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within the phpCAS library that is maintained by a third-party. A remote user can bypass implemented security restrictions and gain unauthorized access to the application.


Affected software

Central Authentication Services (CAS)
Moodle
Ubuntu
Fedora
php-cas (Ubuntu package)
php-pear-CAS
ocsinventory-reports (Ubuntu package)
ocsinventory-server (Ubuntu package)

How to mitigate CVE-2022-39369

Install updates from vendor's website.

Central Authentication Services (CAS) - update to 1.x-1.0.1
Moodle - addressed in versions 3.9.23, 3.11.16, 4.0.10
php-cas (Ubuntu package) - addressed in versions Ubuntu Pro, 1.3.8-1ubuntu0.20.04.1, 1.3.8-1ubuntu0.22.04.1
php-pear-CAS - addressed in versions 1.6.0-1.fc35, 1.6.0-1.fc36, 1.6.0-1.fc37
ocsinventory-reports (Ubuntu package) - update to 2.8.1+dfsg1-1ubuntu0.1
ocsinventory-server (Ubuntu package) - update to 2.8.1+dfsg1-1ubuntu0.1

External References

Related Security Bulletins