PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local…
Priority LOW 16CWE-59Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- None · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
PGTStorage/pgt-file.php in phpCAS before 1.1.3, when proxy mode is enabled, allows local users to overwrite arbitrary files via a symlink attack on an unspecified file.
Why it matters now
EPSS 0.00353 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apereo:phpcas:*:*:*:*:*:*:*:* | up to 1.1.2 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.2:*:*:*:*:*:*:* | 0.2 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.3:*:*:*:*:*:*:* | 0.3 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.3.1:*:*:*:*:*:*:* | 0.3.1 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.3.2:*:*:*:*:*:*:* | 0.3.2 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4:*:*:*:*:*:*:* | 0.4 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.1:*:*:*:*:*:*:* | 0.4.1 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.8:*:*:*:*:*:*:* | 0.4.8 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.9:*:*:*:*:*:*:* | 0.4.9 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.10:*:*:*:*:*:*:* | 0.4.10 | Vulnerable | Apereo |
- cpe:2.3:a:apereo:phpcas:*:*:*:*:*:*:*:* Versions up to 1.1.2 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.3.1:*:*:*:*:*:*:* Versions 0.3.1 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.3.2:*:*:*:*:*:*:* Versions 0.3.2 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.1:*:*:*:*:*:*:* Versions 0.4.1 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.8:*:*:*:*:*:*:* Versions 0.4.8 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.9:*:*:*:*:*:*:* Versions 0.4.9 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.10:*:*:*:*:*:*:* Versions 0.4.10 Vulnerable ·Apereo
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apereo:phpcas:0.4.11:*:*:*:*:*:*:* | 0.4.11 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.12:*:*:*:*:*:*:* | 0.4.12 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.13:*:*:*:*:*:*:* | 0.4.13 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.14:*:*:*:*:*:*:* | 0.4.14 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.15:*:*:*:*:*:*:* | 0.4.15 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.16:*:*:*:*:*:*:* | 0.4.16 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.17:*:*:*:*:*:*:* | 0.4.17 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.18:*:*:*:*:*:*:* | 0.4.18 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.19:*:*:*:*:*:*:* | 0.4.19 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.20:*:*:*:*:*:*:* | 0.4.20 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.21:*:*:*:*:*:*:* | 0.4.21 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.22:*:*:*:*:*:*:* | 0.4.22 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.4.23:*:*:*:*:*:*:* | 0.4.23 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.5.0:*:*:*:*:*:*:* | 0.5.0 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.5.1:*:*:*:*:*:*:* | 0.5.1 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:0.6.0:*:*:*:*:*:*:* | 0.6.0 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Vulnerable | Apereo |
| cpe:2.3:a:apereo:phpcas:1.1.1:*:*:*:*:*:*:* | 1.1.1 | Vulnerable | Apereo |
- cpe:2.3:a:apereo:phpcas:0.4.11:*:*:*:*:*:*:* Versions 0.4.11 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.12:*:*:*:*:*:*:* Versions 0.4.12 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.13:*:*:*:*:*:*:* Versions 0.4.13 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.14:*:*:*:*:*:*:* Versions 0.4.14 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.15:*:*:*:*:*:*:* Versions 0.4.15 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.16:*:*:*:*:*:*:* Versions 0.4.16 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.17:*:*:*:*:*:*:* Versions 0.4.17 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.18:*:*:*:*:*:*:* Versions 0.4.18 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.19:*:*:*:*:*:*:* Versions 0.4.19 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.20:*:*:*:*:*:*:* Versions 0.4.20 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.21:*:*:*:*:*:*:* Versions 0.4.21 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.22:*:*:*:*:*:*:* Versions 0.4.22 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.4.23:*:*:*:*:*:*:* Versions 0.4.23 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.5.1:*:*:*:*:*:*:* Versions 0.5.1 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Vulnerable ·Apereo
- cpe:2.3:a:apereo:phpcas:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Apereo
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2010-3691
- 2026-10-03 Alias added: GHSA-5pj3-8xv9-ch9w
References
Other 10
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=495542#82
- https://issues.jasig.org/browse/PHPCAS-80
- ADV-2011-0456
- ADV-2010-2909
- https://forge.indepnet.net/projects/glpi/repository/revisions/12601
- ADV-2010-2705
- [oss-security] 20100929 CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback
- https://developer.jasig.org/source/changelog/jasigsvn?cs=21538
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback
- [oss-security] 20101001 Re: CVE request - phpCAS: prevent symlink attacks, directory traversal and XSS during a proxy callback
More Apereo Phpcas vulnerabilities
- TI-2014-03410 A URL parameter injection vulnerability was found in the back-channel ticket validation… CVSS 3.1CRITICAL 9.8
- TI-2022-18743 Service Hostname Discovery Exploitation in phpCAS CVSS 3.1HIGH 8.0
- TI-2017-14410 Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20… CVSS 3.0HIGH 8.1
- TI-2010-03516 Directory traversal vulnerability in the callback function in client.php in phpCAS before… CVSS 2.0MEDIUM 6.4
- TI-2012-04698 phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the… CVSS 2.0MEDIUM 5.8
- TI-2012-01010 Improper privilege management in jasig project phpCAS CVSS 3.1MEDIUM 5.3
Sources
- CVE-2010-3691 · CVE Program
- CVE-2010-3691 · NVD
- FIRST EPSS
- GHSA-5pj3-8xv9-ch9w · GitHub Advisory Database · CC BY 4.0
- CVE-2010-3691 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences