CVE-2020-26234: fallo de gravedad media en opencast
Disabled Hostname Verification in OpenCast
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.3%
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Productos afectados
opencast · opencastCVEs relacionadas — opencast
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-43821CRITICALFiles Accessible to External Parties in OpencastEPSS 2.0%CVE-2021-43807HIGHHTTP Method Spoofing in OpencastEPSS 1.5%CVE-2020-5206HIGHAuthentication Bypass For Endpoints With Anonymous Access in OpenCastEPSS 1.3%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2020-5230HIGHOpencast uses unsafe identifiersEPSS 1.2%CVE-2020-5228HIGHOpencast allows unauthorized public access via OAI-PMHEPSS 1.0%