Jasig Cas Client
Monthly
Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).
Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).