CVE-2020-26234 Disabled Hostname Verification in OpenCast

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

CVE-2020-26234

Opencast versions before 8.9 and 7.9 disable HTTPS hostname verification in its HTTP client, enabling potential MITM attacks. Root cause: hostname verification was disabled for a large portion of HTTP requests. Affected component/file: Opencast HTTP client. Impact: confidentiality/integrity conce...

CVE-2020-26234: Origin Validation Error

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

Opencast Access Control Error Vulnerability

Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. A security vulnerability exists in Opencast versions 8.9 and prior to 7.9 that stems from Opencast disabling HTTPS hostname validation, which is used by i...

Opencast Memory Corruption Vulnerability

Opencast is a free and open source video management solution that is scalable, customizable and low cost. Opencast memory corruption vulnerability, no detailed vulnerability details are provided at this time...

Opencast Encryption Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. An encryption issue vulnerability exists in Opencast versions prior to 8.1 and prior to 7.6. The vulnerability stems from a network system or product that does not properly use the relevant...

Opencast Trust Management Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. A trust management issue vulnerability exists in Opencast versions prior to 7.6 and prior to 8.1. The vulnerability stems from the lack of an effective trust management mechanism in a network...

Opencast License Issues Vulnerabilities

Opencast is a free and open source video management solution that is scalable, customizable and low cost. An authorization issue vulnerability exists in Opencast versions prior to 7.6 and prior to 8.1. The vulnerability stems from a lack of authentication measures or insufficient authentication...

Opencast License Issue Vulnerability (CNVD-2020-12671)

Opencast is a free and open source video management solution that is scalable, customizable and low cost. An authorization issue vulnerability exists in Opencast versions prior to 7.6 and prior to 8.1. The vulnerability stems from a lack of authentication measures or insufficient authentication...

Unspecified Vulnerability in Opencast

Opencast is a free and open source video management solution that is scalable, customizable and low cost. A security vulnerability exists in Opencast. The vulnerability stems from a lack of proper validation of user input data by a network system or product during the course of a user's input of ...

Opencast < 7.6.0 and 8.0.0 Multiple Vulnerabilities

Opencast is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Opencast < 8.1.0 Password Hashing Vulnerability

Opencast is prone to an insecure password hashing vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Harded Coded Remember-Me Cookie

Opencast uses a harded coded remember-me cookie. The remember-me cookie is created by hashing the username, password, and an additional system key, allowing anyone with an access to the remember-me token for one server to compromise all servers using the same credentials...

Authentication Bypass

opencast-kernel is vulnerable to authentication bypass. The vulnerability exists as media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default...

Authorization Bypass

opencast-kernel is vulnerable to authorization bypass. The vulnerability exists as a user with the non-standard role, ROLECOURSEADMIN, is able to create new users using the user-utils endpoint...

Authentication Bypass

opencast-kernel is vulnerable to authentication bypass. The vulnerability exists as a fake remember-me token can be used to gain access of arbitrary users without the need to be authenticated...

Weak Encryption Standards

opencast-kernel is vulnerable to weak encryption standards. It uses a broken hashing standard, MD5, to hash sensitive information, such as passwords, for its cookies...

CVE-2020-5206

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...

CVE-2020-5231

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

CVE-2020-5206

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example...