Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.springframework.security/spring-security-cas@3.1.7.RELEASE
Typemaven
Namespaceorg.springframework.security
Namespring-security-cas
Version3.1.7.RELEASE
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version3.1.7.RELEASE
Latest_non_vulnerable_version5.1.5.RELEASE
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-28ru-qm8a-skg3
vulnerability_id VCID-28ru-qm8a-skg3
summary 
Access control bypass via untrusted infomation usage in proxy ticket authentication
When using the CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.
references
0
reference_url https://jira.spring.io/browse/SEC-2688
reference_id
reference_type
scores
url https://jira.spring.io/browse/SEC-2688
1
reference_url https://bugzilla.redhat.com/CVE-2014-3527
reference_id CVE-2014-3527
reference_type
scores
url https://bugzilla.redhat.com/CVE-2014-3527
2
reference_url http://www.gopivotal.com/security/cve-2014-3527
reference_id CVE-2014-3527
reference_type
scores
url http://www.gopivotal.com/security/cve-2014-3527
3
reference_url https://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7
reference_id CVE-2014-3527-FIXED-IN-SPRING-SECURITY-3-2-5-AND-3-1-7
reference_type
scores
url https://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7
fixed_packages
0
url pkg:maven/org.springframework.security/spring-security-cas@3.1.7.RELEASE
purl pkg:maven/org.springframework.security/spring-security-cas@3.1.7.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-cas@3.1.7.RELEASE
1
url pkg:maven/org.springframework.security/spring-security-cas@3.2.5.RELEASE
purl pkg:maven/org.springframework.security/spring-security-cas@3.2.5.RELEASE
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-cas@3.2.5.RELEASE
aliases CVE-2014-3527
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-28ru-qm8a-skg3
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.springframework.security/spring-security-cas@3.1.7.RELEASE