// For flags

CVE-2020-5228

Opencast allows unauthorized public access via OAI-PMH

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

Opencast versiones anteriores a 8.1 y 7.6, permite el acceso público no autorizado para todos los medios y metadatos por defecto por medio de OAI-PMH. OAI-PMH es parte del flujo de trabajo predeterminado y es activada por defecto, requiriendo la intervención activa de los usuarios para proteger los medios. Esto conlleva a que los usuarios, sin saberlo, entreguen un acceso público a eventos sin su conocimiento. El problema ha sido abordado en Opencast versiones 7.6 y 8.1, donde el endpoint OAI-PMH es configurado para solicitar usuarios con "ROLE_ADMIN" por defecto. Además de esto, Opencast versión 9 elimina la publicación OAI-PMH del flujo de trabajo predeterminado, haciendo que la publicación sea una decisión consciente que los usuarios tienen que tomar al actualizar sus flujos de trabajo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-02 CVE Reserved
  • 2020-01-30 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apereo
Search vendor "Apereo"
 Opencast
Search vendor "Apereo" for product "Opencast"
 < 7.6
Search vendor "Apereo" for product "Opencast" and version " < 7.6"
-
Affected
Apereo
Search vendor "Apereo"
 Opencast
Search vendor "Apereo" for product "Opencast"
 8.0
Search vendor "Apereo" for product "Opencast" and version "8.0"
-
Affected