Limited Authentication Bypass for Media Files in Opencast
CVE-2022-29237

5.4MEDIUM

Key Information:

Vendor
Opencast
Status
Opencast
Vendor
CVE Published:
24 May 2022

Summary

Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.

Affected Version(s)

opencast < 10.14 < 10.14

opencast >= 11.0, < 11.7 < 11.0, 11.7

References

https://github.com/opencast/opencast/security/advisories/...
x_refsource_CONFIRM
https://github.com/opencast/opencast/commit/8d5ec1614eed1...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.