PT-2017-10917 · Opencast · Opencast

Publicado 2017-11-17 · Atualizado 2022-05-13 · CVE-2017-1000221

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions 2.2.3 and older

Description The Opencast search service, used for publication to media modules and players, incorrectly handles access control when user names overlap. This allows users to access recordings by matching only part of the restricted user name. For instance, a user with the role ROLE USER can access recordings published for ROLE USER X.

Recommendations For Opencast versions 2.2.3 and older, consider restricting access to the search service until a fix is available, or ensure that user names do not overlap to minimize the risk of incorrect access control. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2017-1000221

GHSA-HX44-C87V-P6XG

Produtos afetados

Opencast

Referências · 5

• 🔥 https://opencast.jira.com/browse/MH-11862 · Exploit
• https://github.com/opencast/opencast/commit/f1abcaf998a469a2081461e0e3b4211927849439 · Nota
• https://osv.dev/vulnerability/GHSA-hx44-c87v-p6xg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000221 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1000221 · Aviso do Fabricante