Code injection

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

CVE-2017-1000221

Opencast CVE-2017-1000221 affects Opencast 2.2.3 and older. The vulnerability arises from the search service used when publishing to media modules and players, where access control is evaluated against user names in a way that allows partial matches. As a result, a user with ROLE_USER could gain ...

CVE-2017-1000217

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0...

CVE-2017-1000221

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role...

CVE-2017-1000217

CVE-2017-1000217 concerns Opencast 2.3.2 and earlier, where the player and media modules are vulnerable to script injection through media/metadata, leading to arbitrary code execution. The issue is described across multiple sources and is fixed in version 2.3.3 and the major release 3.0 . The vul...

Opencast Access Restriction Bypass Vulnerability

Opencast is a free and open source video management solution that is scalable, customizable and low cost. A security vulnerability exists in Opencast 2.2.3 and earlier versions. An attacker can exploit the vulnerability to bypass access restrictions...