// For flags

CVE-2022-29237

Limited Authentication Bypass for Media Files in Opencast

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.

Opencast es una solución gratuita y de código abierto para la captura y distribución automática de vídeo a escala. En versiones anteriores a Opencast versiones 10.14 y 11.7, los usuarios podían pasar URLs de archivos que pertenecían a organizaciones distintas a la del usuario, que Opencast importaba a la organización actual, omitiendo las barreras organizativas. Los atacantes deben tener acceso completo a la interfaz REST de ingesta de Opencast, y también conocer los enlaces internos a los recursos de otra organización del mismo clúster de Opencast. Los usuarios que no ejecutan un clúster multi-tenant no están afectados por este problema. Este problema ha sido corregido en Opencast versiones 10.14 y 11.7

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-04-13 CVE Reserved
  • 2022-05-24 CVE Published
  • 2023-12-15 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apereo
Search vendor "Apereo"
 Opencast
Search vendor "Apereo" for product "Opencast"
 < 10.14
Search vendor "Apereo" for product "Opencast" and version " < 10.14"
-
Affected
Apereo
Search vendor "Apereo"
 Opencast
Search vendor "Apereo" for product "Opencast"
 >= 11.0 < 11.7
Search vendor "Apereo" for product "Opencast" and version " >= 11.0 < 11.7"
-
Affected