PT-2022-26189 · Opencast · Opencast

Gregorydlogan · Published 2022-11-28 · Updated 2022-12-01 · CVE-2022-41965

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 12.5

Description The vulnerability in Opencast's Paella authentication page allows attackers to redirect authenticated users to arbitrary URLs, potentially facilitating phishing attacks or other security issues. This could enable attackers to redirect users to sites outside of their Opencast install.

Recommendations For versions prior to 12.5, update to Opencast 12.5 or newer to resolve the issue. As a temporary workaround, consider restricting access to the Paella authentication page until a patch is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-41965

GHSA-R3QR-VWVG-43F7

Affected Products

Opencast

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41965.json · Exploit
• https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017 · Patch
• https://osv.dev/vulnerability/GHSA-r3qr-vwvg-43f7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41965 · Security Note
• https://github.com/opencast/opencast · Note
• https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7 · Note
• https://t.me/cibsecurity/53605 · Telegram Post