Total vulnerabilities in the database
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| Software | From | Fixed in |
|---|---|---|
| apereo / phpcas | 1.3.0 | 1.3.0.x |
| apereo / phpcas | 1.3.0-rc1 | 1.3.0-rc1.x |
| apereo / phpcas | - | 1.3.1.x |