CVE-2020-5228: Opencast allows unauthorized public access via OAI-PMH
First published: Thu Jan 30 2020(Updated: )
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apereo Opencast | <7.6 | |
| Apereo Opencast | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5228?
CVE-2020-5228 is a vulnerability in Opencast before version 8.1 and 7.6 that allows unauthorized public access to all media and metadata by default via OAI-PMH.
What is the severity of CVE-2020-5228?
The severity of CVE-2020-5228 is high, with a severity value of 7.5.
How does CVE-2020-5228 affect Apereo Opencast?
CVE-2020-5228 affects Apereo Opencast versions up to 7.6 and version 8.0.
How can I fix CVE-2020-5228?
To fix CVE-2020-5228, it is necessary to disable or restrict access to OAI-PMH in Opencast.
Is there any further information available about CVE-2020-5228?
Yes, you can find more information about CVE-2020-5228 at the following references: [Reference 1](https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276) and [Reference 2](https://github.com/opencast/opencast/security/advisories/GHSA-6f54-3qr9-pjgj).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/title
- agent/remedy
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/apereo
- canonical/apereo opencast
- version/apereo opencast/8.0