PT-2025-30942 · Opencast · Opencast

Lkiesow · Published 2021-12-14 · Updated 2025-07-26 · CVE-2025-54380

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 17.6

Description Opencast incorrectly sent hashed global system account credentials (org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when fetching mediapackage elements included in a mediapackage XML file. Individuals with ingest permissions could cause Opencast to send these credentials to a URL of their choosing. A previous issue prevented some instances of this, but not all.

Recommendations Upgrade to Opencast version 17.6 or later.

Exploit

Fix

Information Disclosure

Insufficiently Protected Credentials

Weakness Enumeration

CWE-200

CWE-522

Related Identifiers

CVE-2025-54380

GHSA-HCXX-MP6G-6GR9

GHSA-J63H-HMGW-X4J7

Affected Products

Opencast

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54380.json · Exploit
• https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a · Patch
• https://github.com/opencast/opencast/security/advisories/GHSA-j63h-hmgw-x4j7 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcxx-mp6g-6gr9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54380 · Security Note
• https://osv.dev/vulnerability/GHSA-j63h-hmgw-x4j7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16153 · Security Note
• https://github.com/opencast/opencast · Note
• https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6 · Note
• https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9 · Note
• https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51 · Note
• https://apereo.org/projects/opencast/news · Note
• https://github.com/advisories/GHSA-hcxx-mp6g-6gr9 · Note
• https://docs.opencast.org/r/10.x/admin/#changelog · Note