CVE-2020-5206: falha de alta gravidade em opencast
Authentication Bypass For Endpoints With Anonymous Access in OpenCast
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.3%
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Produtos afetados
opencast · opencastCVEs relacionadas — opencast
No mesmo produto, das mais perigosas para as menos.
CVE-2021-43821CRITICALFiles Accessible to External Parties in OpencastEPSS 2.0%CVE-2021-43807HIGHHTTP Method Spoofing in OpencastEPSS 1.5%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2020-5230HIGHOpencast uses unsafe identifiersEPSS 1.2%CVE-2020-5228HIGHOpencast allows unauthorized public access via OAI-PMHEPSS 1.0%CVE-2020-5222MEDIUMHard-Coded Key Used For Remember-me Token in OpenCastEPSS 0.9%