PT-2022-19487 · Opencast · Opencast

Lkiesow · Published 2022-05-24 · Updated 2022-06-07 · CVE-2022-29237

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 10.14 and 11.7

Description Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to versions 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue.

Recommendations For Opencast versions prior to 10.14, update to version 10.14 or later. For Opencast versions prior to 11.7, update to version 11.7 or later. As a temporary workaround, consider restricting access to Opencast's ingest REST interface until a patch is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-29237

GHSA-QM6V-CG9V-53J3

Affected Products

Opencast

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29237.json · Exploit
• https://github.com/opencast/opencast/security/advisories/GHSA-qm6v-cg9v-53j3 · Patch
• https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7 · Patch
• https://osv.dev/vulnerability/CVE-2022-29237 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qm6v-cg9v-53j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29237 · Security Note
• https://github.com/opencast/opencast · Note
• https://t.me/cibsecurity/43252 · Telegram Post