News
Vigil@nce - Drupal CAS: information disclosure about user accounts
April 2016 by Vigil@nce
SYNTHESIS OF THE VULNERABILITY
An attacker can query the CAS server of Drupal CAS, in order to
obtain private information.
Impacted products: Drupal Modules not comprehensive.
Severity: 2/4.
Creation date: 11/02/2016.
DESCRIPTION OF THE VULNERABILITY
The CAS module can be installed on Drupal.
This module may be used as a CAS server for centralized user
authentication. However, the module does not define access rules
applicable to CAS clients. So unauthorized clients can get
personal but non secret data about the user accounts that this CAS
server manages.
An attacker can therefore query the CAS server of Drupal CAS, in
order to obtain private information.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/Drupal-CAS-information-disclosure-about-user-accounts-18926
