CVE-2018-16153 Opencast publishes global system account credentials
Apereo Opencast leaks system digest credentials to external services during authentication, exposing sensitive data to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16153?
CVE-2018-16153 is a high-severity vulnerability in n/a, published on 12 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.
Weakness: CWE-522
Which versions are affected by CVE-2018-16153?
2 open source packages ship an affected version, including org.opencastproject:opencast-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opencastproject:opencast-common Maven | All versions | 10.6 |
org.opencastproject:opencast-common Maven | All versions | 10.6 |
Products include Apereo Opencast.
How do I fix CVE-2018-16153?
Upgrade org.opencastproject:opencast-common to 10.6 or later.
Is CVE-2018-16153 being exploited?
There is no known exploitation of CVE-2018-16153 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-43821 Files Accessible to External Parties in Opencast
- CVE-2020-5206 Authentication Bypass For Endpoints With Anonymous Access in OpenCast
- CVE-2021-32623 Opencast vulnerable to billion laughs attack (XML bomb)
- CVE-2020-5229 Opencast stores passwords using outdated MD5 hash algorithm
- CVE-2020-5230 Opencast uses unsafe identifiers
Sources
Also known as GHSA-hcxx-mp6g-6gr9.