PT-2021-14415 · Opencast · Opencast

Lowlkiesow · Published 2021-02-18 · Updated 2021-02-26 · CVE-2021-21318

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 9.2

Description The issue affects Opencast, a free, open-source platform for managing educational audio and video content. In affected versions, publishing an episode with strict access rules overwrites the currently set series access, allowing for easy denial of access for all users without superuser privileges and effectively hiding the series. Access to series and series metadata on the search service depends on the events published, which are part of the series. However, affected versions of Opencast may not update the series access or remove a published series if an event is being removed, leading to inconsistent access control lists or series metadata still being available after all episodes have been removed.

Recommendations For Opencast versions prior to 9.2, update to version 9.2 to resolve the issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-21318

GHSA-VPC2-3WCV-QJ4W

Affected Products

Opencast

References · 5

• https://github.com/opencast/opencast/commit/b18c6a7f81f08ed14884592a6c14c9ab611ad450 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21318 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21318 · Vendor Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-vpc2-3wcv-qj4w · Note
• https://t.me/cibsecurity/23824 · Telegram Post