Opencast
Monthly
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.
Session fixation in the default security configuration of Opencast prior to 19.7 and 20.2 lets an unauthenticated attacker who can deliver a crafted link to a victim hijack that victim's authenticated session. Because the shipped etc/security/mh_default_org.xml accepts a client-supplied JSESSIONID via the ;jsessionid= URL path parameter and does not regenerate the identifier at login, an attacker who knows the fixated value can reuse it once the victim authenticates - exposing the victim's data and actions, and escalating to full administrative account takeover when the victim is an administrator. Exploitation requires user interaction (the victim must open the link while holding no active Opencast session cookie and then log in), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Opencast Editor before 17.8 and 18.2 can execute a previously selected publish workflow when an authenticated user with write access clicks 'Save & Publish' and then chooses 'Save', potentially exposing internal media without notification. The issue is a low-severity information-disclosure risk because the actor must already have event write access, must deliberately use the editor, and must follow that specific action order; the vendor notes real-world impact is very low. Publicly available exploit code exists, but EPSS is only 0.29% and active exploitation is not confirmed by CISA KEV.
Stored cross-site scripting in Opencast Paella Player 7 lets authenticated users with media write access inject HTML and JavaScript through event or series metadata, which then executes in the browsers of viewers who open the prepared media. Opencast 17.x before 17.8 and 18.x before 18.2 are affected; exploitation requires a writer account plus a victim viewing the player, and the assessed vector is CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS is low at 0.21% (11th percentile), no public exploit was identified at time of analysis, and CISA KEV does not list this issue.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast is free and open source software for automated video capture and distribution. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Opencast is a free and open source solution for automated video capture and distribution at scale. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Opencast is a free and open source solution for automated video capture and distribution. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable.
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Stored DOM-based cross-site scripting in Paella Player's closed-caption rendering path (paella-core before 2.12.11) allows an attacker who controls caption/cue text to inject markup that executes in the browser of any viewer who plays the affected video with captions enabled. In Opencast deployments (before 19.7 and 20.2), which bundle the vulnerable paella-core renderer, exploitation typically requires an authenticated author or contributor with content-upload privileges (PR:L) to attach a malicious WebVTT or DFXP subtitle track, and a victim must then actively play that video (UI:R) - it is not a zero-click drive-by, and default caption-displaying configurations are sufficient with no special toggle required. The issue is confirmed by vendor advisory GHSA-m6c8-jcw2-5r25 and the source-level fix, with an assessed CVSS of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N); no public exploit code has been identified at time of analysis.
Session fixation in the default security configuration of Opencast prior to 19.7 and 20.2 lets an unauthenticated attacker who can deliver a crafted link to a victim hijack that victim's authenticated session. Because the shipped etc/security/mh_default_org.xml accepts a client-supplied JSESSIONID via the ;jsessionid= URL path parameter and does not regenerate the identifier at login, an attacker who knows the fixated value can reuse it once the victim authenticates - exposing the victim's data and actions, and escalating to full administrative account takeover when the victim is an administrator. Exploitation requires user interaction (the victim must open the link while holding no active Opencast session cookie and then log in), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Opencast Editor before 17.8 and 18.2 can execute a previously selected publish workflow when an authenticated user with write access clicks 'Save & Publish' and then chooses 'Save', potentially exposing internal media without notification. The issue is a low-severity information-disclosure risk because the actor must already have event write access, must deliberately use the editor, and must follow that specific action order; the vendor notes real-world impact is very low. Publicly available exploit code exists, but EPSS is only 0.29% and active exploitation is not confirmed by CISA KEV.
Stored cross-site scripting in Opencast Paella Player 7 lets authenticated users with media write access inject HTML and JavaScript through event or series metadata, which then executes in the browsers of viewers who open the prepared media. Opencast 17.x before 17.8 and 18.x before 18.2 are affected; exploitation requires a writer account plus a victim viewing the player, and the assessed vector is CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS is low at 0.21% (11th percentile), no public exploit was identified at time of analysis, and CISA KEV does not list this issue.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast is free and open source software for automated video capture and distribution. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.
Opencast is a free and open source solution for automated video capture and distribution at scale. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast is an Open Source Lecture Capture & Video Management for Education. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Opencast is a free and open source solution for automated video capture and distribution. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast is a free, open-source platform to support the management of educational audio and video content. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable.
In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.