CVE-2020-5229: Use of a Broken or Risky Cryptographic Algorithm

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially...

CVE-2020-5231: Improper Authorization

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

PT-2020-18325

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 8.1 Description The issue concerns the use of the outdated and cryptographically insecure MD5 hash algorithm for storing passwords. The hashes are salted using the username instead of a random salt, which can cause...

Opencast <= 2.3.2 RCE Vulnerability

Opencast through version 2.3.2 is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if...

Opencast <= 2.2.3 Authentication Bypass Vulnerability

Opencast through version 2.2.3 is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if descripti...

Opencast Detection (HTTP)

HTTP based detection of Opencast. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Opencast Default Credentials (HTTP)

Opencast is using known default credentials. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Opencast player and media module script injection vulnerability

Opencast is an open source video management solution . player is one of the video player ; media module is one of the multimedia module . A script injection vulnerability exists in the player and media modules in Opencast 2.3.2 and earlier versions. An attacker can exploit this vulnerability to...

Code injection

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

CVE-2017-1000217

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

Design/Logic Flaw

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

CVE-2017-1000221

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

CVE-2017-1000217

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

CVE-2017-1000221

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

CVE-2017-1000221

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

CVE-2017-1000217

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

CVE-2017-1000221

Opencast CVE-2017-1000221 affects Opencast 2.2.3 and older. The vulnerability arises from the search service used when publishing to media modules and players, where access control is evaluated against user names in a way that allows partial matches. As a result, a user with ROLE_USER could gain ...

CVE-2017-1000217

CVE-2017-1000217 concerns Opencast 2.3.2 and earlier, where the player and media modules are vulnerable to script injection through media/metadata, leading to arbitrary code execution. The issue is described across multiple sources and is fixed in version 2.3.3 and the major release 3.0 . The vul...

CVE-2017-1000221

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

PT-2017-10913

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 2.3.3 Opencast versions prior to 3.0 Description The issue allows for script injections through media and metadata in the player and media module, resulting in arbitrary code execution. Recommendations For Opencast...