PT-2017-10917 · Opencast · Opencast

Published 2017-11-17 · Updated 2022-05-13 · CVE-2017-1000221

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions 2.2.3 and older

Description The Opencast search service, used for publication to media modules and players, incorrectly handles access control when user names overlap. This allows users to access recordings by matching only part of the restricted user name. For instance, a user with the role ROLE USER can access recordings published for ROLE USER X.

Recommendations For Opencast versions 2.2.3 and older, consider restricting access to the search service until a fix is available, or ensure that user names do not overlap to minimize the risk of incorrect access control. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2017-1000221

GHSA-HX44-C87V-P6XG

Affected Products

Opencast

References · 5

• 🔥 https://opencast.jira.com/browse/MH-11862 · Exploit
• https://osv.dev/vulnerability/GHSA-hx44-c87v-p6xg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000221 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1000221 · Vendor Advisory
• https://github.com/opencast/opencast/commit/f1abcaf998a469a2081461e0e3b4211927849439 · Note