PT-2020-18326 · Opencast Community · Opencast

Lkiesow · Published 2020-01-30 · Updated 2020-02-10 · CVE-2020-5230

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1

Description The issue allows almost arbitrary identifiers for media packages and elements to be used, which can be problematic for operation and security. This is because such identifiers are sometimes used for file system operations, which may lead to an attacker being able to escape working directories and write files to other locations. Additionally, Opencast's Id.toString() vs Id.compact() behavior can cause errors due to identifier mismatch since an identifier may unintentionally change.

Recommendations For Opencast versions prior to 7.6, update to version 7.6 or later to resolve the issue. For Opencast versions prior to 8.1, update to version 8.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of arbitrary identifiers for media packages and elements to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-99

CWE-74

Related Identifiers

CVE-2020-5230

GHSA-W29M-FJP4-QHMQ

Affected Products

Opencast

References · 6

• https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5230 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5230 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w29m-fjp4-qhmq · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmq · Note
• https://t.me/cvenotify/682 · Telegram Post