Central Authentication System Cas Server
Monthly
Open redirect in the Drupal Central Authentication System (CAS) Server contrib module lets remote, unauthenticated attackers craft CAS URLs that send victims to an untrusted site, which can be used to fake the source of data and support phishing. Affected deployments are the 0.x-2.0.x branch before 2.0.4 and the 2.1.x branch from 2.1.0 through 2.1.2; the reporter scored it 6.5, but exploitation depends on a victim following the crafted URL. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and vendor patches are available in 2.0.4 and 2.1.3.
Open redirect in the Drupal Central Authentication System (CAS) Server contrib module lets remote, unauthenticated attackers craft CAS URLs that send victims to an untrusted site, which can be used to fake the source of data and support phishing. Affected deployments are the 0.x-2.0.x branch before 2.0.4 and the 2.1.x branch from 2.1.0 through 2.1.2; the reporter scored it 6.5, but exploitation depends on a victim following the crafted URL. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and vendor patches are available in 2.0.4 and 2.1.3.