org.apache.nifi:nifi-bootstrap (>=1.14.0, <=1.15.3), org.apache.nifi:nifi-single-user-iaa-providers (>=1.14.0, <=1.15.3) +2 more potentially affected by CVE-2022-26850 via org.apache.nifi:nifi-single-user-utils (>=1.14.0, <=1.15.3)

org.apache.nifi:nifi-single-user-utils MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.14.0, =1.14.0, =1.15.3 Source cves: CVE-2022-26850 Source advisory: GHSA-RVP4-R3G6-8HXQ...

org.apache.nifi:nifi-bootstrap (>=1.14.0, <=1.15.3), org.apache.nifi:nifi-single-user-iaa-providers (>=1.14.0, <=1.15.3) +2 more potentially affected by CVE-2022-26850 via org.apache.nifi:nifi-single-user-utils (>=1.14.0, <=1.15.3)

org.apache.nifi:nifi-single-user-utils MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.14.0, =1.14.0, =1.15.3 Source cves: CVE-2022-26850 Source advisory: OSV:GHSA-RVP4-R3G6-8HXQ...

CVE-2020-5231

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

PT-2020-18327

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 7.6 Opencast versions prior to 8.1 Description The issue allows users with the role ROLE COURSE ADMIN to create new users not including the role ROLE ADMIN using the "user-utils" endpoint. ROLE COURSE ADMIN is a...

PT-2020-18325

Name of the Vulnerable Software and Affected Versions Opencast versions prior to 8.1 Description The issue concerns the use of the outdated and cryptographically insecure MD5 hash algorithm for storing passwords. The hashes are salted using the username instead of a random salt, which can cause...

CVE-2020-5231: Improper Authorization

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...