CVE-2018-13257

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-18 · updated 2026-06-17
Weakness: CWE-601

Description

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.

Affected products

Blackboard Learn: 2018-07-02

References

https://github.com/gluxon/CVE-2018-13257
https://github.com/gluxon/CVE-2018-13257

Get alerted when CVE-2018-13257 or the next vulnerability affects your stack