What is CVE-2020-5222?

CVE-2020-5222 is a vulnerability in Opencast versions before 7.6 and 8.1 that enables a remember-me cookie based on a hash created from the username, password, and an additional system key.

How does CVE-2020-5222 affect Opencast?

CVE-2020-5222 affects Opencast versions before 7.6 and 8.1, allowing an attacker who gains access to a remember-me token for one server to access all servers that use the same credentials.

What is the severity of CVE-2020-5222?

CVE-2020-5222 has a severity level of 8.8 (high).

How can I fix CVE-2020-5222?

To fix CVE-2020-5222, you should update Opencast to version 7.6 or 8.1, which include the necessary security patches.

Where can I find more information about CVE-2020-5222?

You can find more information about CVE-2020-5222 in the Opencast GitHub commit and the Opencast security advisory mentioned in the references.

Vulnerability/
CVE-2020-5222

high

8.8

CWE

798

30/1/2020

4/8/2024

CVE-2020-5222: Hard-Coded Key Used For Remember-me Token in OpenCast

First published: Thu Jan 30 2020(Updated: )

Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Apereo Opencast	<7.6
Apereo Opencast	=8.0

Remedy

https://github.com/opencast/opencast/commit/1a7172c95af8d542a77ae5b153e4c834dd4788a6

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2020-5222?
CVE-2020-5222 is a vulnerability in Opencast versions before 7.6 and 8.1 that enables a remember-me cookie based on a hash created from the username, password, and an additional system key.
How does CVE-2020-5222 affect Opencast?
CVE-2020-5222 affects Opencast versions before 7.6 and 8.1, allowing an attacker who gains access to a remember-me token for one server to access all servers that use the same credentials.
What is the severity of CVE-2020-5222?
CVE-2020-5222 has a severity level of 8.8 (high).
How can I fix CVE-2020-5222?
To fix CVE-2020-5222, you should update Opencast to version 7.6 or 8.1, which include the necessary security patches.
Where can I find more information about CVE-2020-5222?
You can find more information about CVE-2020-5222 in the Opencast GitHub commit and the Opencast security advisory mentioned in the references.

collector/nvd-index
agent/references
agent/softwarecombine
agent/type
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/severity
agent/remedy
agent/weakness
agent/author
agent/title
agent/description
agent/tags
agent/event
agent/first-publish-date
vendor/apereo
canonical/apereo opencast
version/apereo opencast/8.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.