CVE-2020-26234: falha de média gravidade em opencast
Disabled Hostname Verification in OpenCast
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.3%
Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Produtos afetados
opencast · opencastCVEs relacionadas — opencast
No mesmo produto, das mais perigosas para as menos.
CVE-2021-43821CRITICALFiles Accessible to External Parties in OpencastEPSS 2.0%CVE-2021-43807HIGHHTTP Method Spoofing in OpencastEPSS 1.5%CVE-2020-5206HIGHAuthentication Bypass For Endpoints With Anonymous Access in OpenCastEPSS 1.3%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2020-5230HIGHOpencast uses unsafe identifiersEPSS 1.2%CVE-2020-5228HIGHOpencast allows unauthorized public access via OAI-PMHEPSS 1.0%