CVE-2010-3691 Path traversal in n/a

What is CVE-2010-3691?

CVE-2010-3691 is a low-severity path traversal vulnerability in n/a, published on 7 Oct 2010. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file.

Weakness: CWE-59

Which versions are affected by CVE-2010-3691?

It affects 1 product.

Products include Apereo Phpcas.

How do I fix CVE-2010-3691?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2010-3691 being exploited?

There is no known exploitation of CVE-2010-3691 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-1000071 Auth bypass in n/a High 8.1
• CVE-2022-39369 Service Hostname Discovery Exploitation in phpCAS High 8.0
• CVE-2010-3692 Path traversal in n/a Medium 6.4
• CVE-2012-5583 Weak cryptography in n/a Medium 5.8
• CVE-2012-1105 Information disclosure in php-pear-CAS Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5pj3-8xv9-ch9w.