2 lines
2.7 KiB
JSON
2 lines
2.7 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://www.drupal.org/project/cas_server","defaultStatus":"unaffected","product":"Central Authentication System (CAS) Server","repo":"https://git.drupalcode.org/project/cas_server","vendor":"Drupal","versions":[{"lessThan":"2.0.3","status":"affected","version":"0.0.0","versionType":"semver"},{"lessThan":"2.1.2","status":"affected","version":"2.1.0","versionType":"semver"}]}],"source":"mlhess@drupal.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:jtenman:central_authentication_system_server:*:*:*:*:*:drupal:*:*","matchCriteriaId":"667508E4-C557-47F0-8038-58B3CAF1851E","versionEndExcluding":"2.0.3","vulnerable":true},{"criteria":"cpe:2.3:a:jtenman:central_authentication_system_server:*:*:*:*:*:drupal:*:*","matchCriteriaId":"1925AABB-E45D-40EC-9357-07091200BF4B","versionEndExcluding":"2.1.2","versionStartIncluding":"2.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2."},{"lang":"es","value":"Inyección XML (también conocida como Inyección XPath Ciega) vulnerabilidad en el servidor del Sistema de Autenticación Central (CAS) de Drupal permite la escalada de privilegios. Este problema afecta al servidor del Sistema de Autenticación Central (CAS): desde 0.0.0 anterior a 2.0.3, desde 2.1.0 anterior a 2.1.2."}],"id":"CVE-2026-1554","lastModified":"2026-06-17T10:16:03.767","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1554","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-05T15:14:46.442485Z","version":"2.0.3"}}]},"published":"2026-02-04T21:15:59.427","references":[{"source":"mlhess@drupal.org","tags":["Vendor Advisory"],"url":"https://www.drupal.org/sa-contrib-2026-007"}],"sourceIdentifier":"mlhess@drupal.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-91"}],"source":"mlhess@drupal.org","type":"Secondary"}]}
|