CVE-2020-5230 Opencast uses unsafe identifiers

2020-01-3020:55:14

CWE-99

GitHub_M

www.cve.org

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast’s Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.

CNA Affected

[
  {
    "product": "opencast",
    "vendor": "opencast",
    "versions": [
      {
        "status": "affected",
        "version": "< 7.6"
      },
      {
        "status": "affected",
        "version": ">= 8.0, < 8.1"
      }
    ]
  }
]