CVE-2020-5206: Authentication Bypass For Endpoints With Anonymous Access in OpenCast
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
opencastto a version that resolves this vulnerability.Fixed in 7.6 - Upgrade
Upgrade
opencastto a version that resolves this vulnerability.Fixed in 8.1
Event History
Frequently Asked Questions
What is CVE-2020-5206?
CVE-2020-5206 is a vulnerability in Opencast versions before 7.6 and 8.1 that allows an attacker to assume proper authentication for a user by using a remember-me cookie with an arbitrary username.
How severe is CVE-2020-5206?
CVE-2020-5206 has a severity score of 10 out of 10, making it critical.
Which versions of Opencast are affected by CVE-2020-5206?
Opencast versions before 7.6 and 8.1 are affected by CVE-2020-5206.
How can an attacker exploit CVE-2020-5206?
An attacker can exploit CVE-2020-5206 by using a remember-me cookie with an arbitrary username, causing Opencast to assume proper authentication for that user.
Are there any available patches or fixes for CVE-2020-5206?
Yes, Opencast has released patches for CVE-2020-5206. It is recommended to update to Opencast version 7.6 or 8.1 to fix this vulnerability.