EUVD-2020-0261

Malware in sbrugna...

Authorization Bypass

opencast-kernel is vulnerable to authorization bypass. The vulnerability exists as a user with the non-standard role, ROLECOURSEADMIN, is able to create new users using the user-utils endpoint...

Default configuration

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

CVE-2020-5231 Opencast users with ROLE_COURSE_ADMIN can create new users

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...