CVE-2010-3692 Path traversal in n/a

What is CVE-2010-3692?

CVE-2010-3692 is a medium-severity path traversal vulnerability in n/a, published on 7 Oct 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in the callback function in client.php in phpCAS before 1.1.3, when proxy mode is enabled, allows remote attackers to create or overwrite arbitrary files via directory traversal sequences in a Proxy Granting Ticket IOU (PGTiou) parameter.

Weakness: CWE-22

Which versions are affected by CVE-2010-3692?

It affects 1 product.

Products include Apereo Phpcas.

How do I fix CVE-2010-3692?

Upgrade to a fixed version.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2010-3692 being exploited?

There is no known exploitation of CVE-2010-3692 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-1000071 Auth bypass in n/a High 8.1
• CVE-2022-39369 Service Hostname Discovery Exploitation in phpCAS High 8.0
• CVE-2012-5583 Weak cryptography in n/a Medium 5.8
• CVE-2012-1105 Information disclosure in php-pear-CAS Medium 5.5
• CVE-2012-1104 Security feature bypass in phpCAS Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-86jv-39rm-gf4v.