CVE:CVE-2014-4172
CNNVD:CNNVD-201408-509
Jasig Multiple CAS Clients等都是CAS客户端。
Jasig Java CAS Client 3.3.2之前版本、.NET CAS Client 1.0.2之前版本和phpCAS 1.3.3之前版本中的的CAS协议存在注入漏洞。远程攻击者可利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade apereo .net_cas_client to a higher version than 1.0.2,and avoid the version (,1.0.2); Upgrade apereo java_cas_client to a higher version than 3.3.2,and avoid the version (,3.3.2); Upgrade apereo phpcas to a higher version than 1.3.3,and avoid the version (,1.3.3); Upgrade debian debian_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade fedoraproject fedora to a higher version than 20,and avoid the version 20