CVE-2020-5228: Opencast allows unauthorized public access via OAI-PMH
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with ROLEADMIN by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the OAI-PMH endpoint to require users with `ROLE_ADMIN` by default (addressed in Opencast 7.6 and 8.1).
Opencast OAI-PMH endpoint required role / access control = ROLE_ADMIN - Configuration
Remove OAI-PMH publication from the default workflow so publication via OAI-PMH is a conscious user decision by updating workflows (as in Opencast 9).
Opencast default workflow OAI-PMH publication in default workflow = removed/disabled by default
Event History
Frequently Asked Questions
What is CVE-2020-5228?
CVE-2020-5228 is a vulnerability in Opencast before version 8.1 and 7.6 that allows unauthorized public access to all media and metadata by default via OAI-PMH.
What is the severity of CVE-2020-5228?
The severity of CVE-2020-5228 is high, with a severity value of 7.5.
How does CVE-2020-5228 affect Apereo Opencast?
CVE-2020-5228 affects Apereo Opencast versions up to 7.6 and version 8.0.
How can I fix CVE-2020-5228?
To fix CVE-2020-5228, it is necessary to disable or restrict access to OAI-PMH in Opencast.
Is there any further information available about CVE-2020-5228?
Yes, you can find more information about CVE-2020-5228 at the following references: [Reference 1](https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276) and [Reference 2](https://github.com/opencast/opencast/security/advisories/GHSA-6f54-3qr9-pjgj).