Vulnerabilities > CVE-2020-5228 - Missing Authorization vulnerability in Apereo Opencast

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

apereo

CWE-862

NVD

Published: 2020-01-30

Updated: 2024-11-21

Summary

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

Vulnerable Configurations

Part	Description	Count
Application	Apereo Apereo Opencast 8.0 Apereo Opencast 1.3.0 Apereo Opencast 1.3.1 Apereo Opencast 1.4 Apereo Opencast 1.4.1 Apereo Opencast 1.4.2 Apereo Opencast 1.4.3 Apereo Opencast 1.4.4 Apereo Opencast 1.5.0 Apereo Opencast 1.5.1 Apereo Opencast 1.6.0 Apereo Opencast 1.6.1 Apereo Opencast 1.6.2 Apereo Opencast 1.6.3 Apereo Opencast 2.0.0 Apereo Opencast 2.0.1 Apereo Opencast 2.0.2 Apereo Opencast 2.1.0 Apereo Opencast 2.1.1 Apereo Opencast 2.1.2 Apereo Opencast 2.2.0 Apereo Opencast 2.2.1 Apereo Opencast 2.2.2 Apereo Opencast 2.2.3 Apereo Opencast 2.2.4 Apereo Opencast 2.2.5 Apereo Opencast 2.3.0 Apereo Opencast 2.3.1 Apereo Opencast 2.3.2 Apereo Opencast 2.3.3 Apereo Opencast 2.3.4 Apereo Opencast 2.3.5 Apereo Opencast 3.0 Apereo Opencast 3.1 Apereo Opencast 3.2 Apereo Opencast 3.3 Apereo Opencast 3.4 Apereo Opencast 3.5 Apereo Opencast 3.6 Apereo Opencast 3.7 Apereo Opencast 4.0 Apereo Opencast 4.1 Apereo Opencast 4.2 Apereo Opencast 4.3 Apereo Opencast 4.4 Apereo Opencast 4.5 Apereo Opencast 5.0 Apereo Opencast 5.1 Apereo Opencast 5.2 Apereo Opencast 5.3 Apereo Opencast 5.4 Apereo Opencast 5.5 Apereo Opencast 6.0 Apereo Opencast 6.1 Apereo Opencast 6.2 Apereo Opencast 6.3 Apereo Opencast 6.4 Apereo Opencast 6.5 Apereo Opencast 6.6 Apereo Opencast 6.7 Apereo Opencast 7.0 Apereo Opencast 7.1 Apereo Opencast 7.2 Apereo Opencast 7.3 Apereo Opencast 7.4 Apereo Opencast 7.5	136

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References