CVE-2026-1554
Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
Résumé
Central Authentication System (CAS) Server - Less critical - XML Element Injection - SA-CONTRIB-2026-007
Description d'origine
La description telle que publiée par la source (souvent en anglais).
XML Injection (aka Blind XPath Injection) vulnerability in Drupal Central Authentication System (CAS) Server allows Privilege Escalation.This issue affects Central Authentication System (CAS) Server: from 0.0.0 before 2.0.3, from 2.1.0 before 2.1.2.
Paquets affectés
Packagist:https://packages.drupal.org/8
drupal/cas_server
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}],"database_specific":{"constraint":"<2.0.3"}},{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.2"}],"database_specific":{"constraint":">=2.1.0 <2.1.2"}}]
Références
- advisory github.com
- advisory nvd.nist.gov
- web drupal.org
- web git.drupalcode.org
- web drupal.org