CVE-2020-5228 Opencast allows unauthorized public access via OAI-PMH
Attackers can access all media and metadata without authentication because the OAI-PMH endpoint is publicly accessible by default in Opencast.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5228?
CVE-2020-5228 is a high-severity missing authorization vulnerability in opencast, published on 30 Jan 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.
Weakness: CWE-862
Which versions are affected by CVE-2020-5228?
4 open source packages ship an affected version, including org.opencastproject:opencast-oaipmh-api. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.opencastproject:opencast-oaipmh-api Maven | All versions | 7.6 |
org.opencastproject:opencast-oaipmh-api Maven | All versions | 7.6 |
org.opencastproject:opencast-oaipmh-api Maven | From 8.0 | 8.1 |
org.opencastproject:opencast-oaipmh-api Maven | From 8.0 | 8.1 |
Products include Apereo Opencast.
How do I fix CVE-2020-5228?
Upgrade org.opencastproject:opencast-oaipmh-api to a fixed version for your release line: 7.6 or 8.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-5228 being exploited?
There is no known exploitation of CVE-2020-5228 in the wild and no public exploit code.
Other vulnerabilities in opencast
- CVE-2021-43821 Files Accessible to External Parties in Opencast
- CVE-2020-5206 Authentication Bypass For Endpoints With Anonymous Access in OpenCast
- CVE-2021-32623 Opencast vulnerable to billion laughs attack (XML bomb)
- CVE-2020-5229 Opencast stores passwords using outdated MD5 hash algorithm
- CVE-2020-5230 Opencast uses unsafe identifiers
Sources
Also known as GHSA-6f54-3qr9-pjgj.