PT-2020-18303 · Opencast Community · Opencast

Lkiesow · Published 2020-01-30 · Updated 2020-02-05 · CVE-2020-5206

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1

Description Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.

Recommendations For Opencast versions prior to 7.6, update to Opencast 7.6 to fix the issue. For Opencast versions prior to 8.1, update to Opencast 8.1 to fix the issue. As a temporary workaround for older, unpatched versions, consider disabling remember-me cookies in etc/security/mh default org.xml by removing the line <sec:remember-me … /> to mitigate the problem.

Fix

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

Related Identifiers

CVE-2020-5206

GHSA-VMM6-W4CF-7F3X

Affected Products

Opencast

References · 6

• https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5206 · Security Note
• https://osv.dev/vulnerability/GHSA-vmm6-w4cf-7f3x · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5206 · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3x · Note
• https://t.me/cvenotify/685 · Telegram Post