PT-2020-18324 · Opencast Community · Opencast

Published 2020-01-30 · Updated 2020-02-05 · CVE-2020-5228

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1

Description The issue allows unauthorized public access to all media and metadata by default via OAI-PMH, which is part of the default workflow and is activated by default. This leads to users unknowingly handing out public access to events without their knowledge. The OAI-PMH endpoint is configured to require users with ROLE ADMIN by default in Opencast 7.6 and 8.1. Additionally, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

Recommendations For Opencast versions prior to 7.6, update to version 7.6 or later to address the issue. For Opencast versions prior to 8.1, update to version 8.1 or later to address the issue. As a temporary workaround, consider changing the roles required for accessing /oaipmh from ROLE ANONYMOUS to ROLE ADMIN in the organization security configuration (etc/security/mh default org.xml).

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2020-5228

GHSA-6F54-3QR9-PJGJ

Affected Products

Opencast

References · 6

• https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5228 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5228 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6f54-3qr9-pjgj · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-6f54-3qr9-pjgj · Note
• https://t.me/cvenotify/669 · Telegram Post