Hard-Coded Key Used For Remember-me Token in OpenCast
CVE-2020-5222

6.8MEDIUM

Key Information:

Vendor
Opencast
Status
Opencast
Vendor
CVE Published:
30 January 2020

Summary

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1

Affected Version(s)

opencast < 7.6 < 7.6

opencast >= 8.0, < 8.1 < 8.0, 8.1

References

https://github.com/opencast/opencast/security/advisories/...
x_refsource_CONFIRM
https://github.com/opencast/opencast/commit/1a7172c95af8d...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.