CVE-2014-2296
High
Description
XML external entity (XXE) vulnerability in java/org/jasig/cas/util/SamlUtils.java in Jasig CAS server before 3.4.12.1 and 3.5.x before 3.5.2.1, when Google Accounts Integration is enabled, allows remote unauthenticated users to bypass authentication via crafted XML data.
SeverityHigh
CVSS8.8
Exploit probability—
ProductApereo Cas Server
PublishedJul 20, 2018
First seenJul 20, 2018
How to fix
Update
- apereo cas_server3.4.12.1, 3.5.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apereo cas_server | v < 3.4.12.1, 3.5 ≤ v < 3.5.2.1 | 3.4.12.1, 3.5.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.