CVE-2025-54380: Opencast still publishes global system account credentials
Description Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. The remainder are addressed with this patch.
Impact Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.
Patches This issue is fixed in Opencast 17.6
If you have any questions or comments about this advisory: - Open an issue in our issue tracker - Email us at security@opencast.org
Other sources
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54380?
CVE-2025-54380 has a severity level that is categorized based on the potential impact of the vulnerability, including the risk of exposing hashed global system account credentials.
How do I fix CVE-2025-54380?
To fix CVE-2025-54380, upgrade to Opencast version 17.6 or later, as this version addresses the vulnerability.
What software is affected by CVE-2025-54380?
CVE-2025-54380 affects multiple components of Opencast including the opencast-publication-service-oaipmh-remote, opencast-kernel, opencast-ingest-service-impl, and opencast-common packages prior to version 17.6.
What type of information is exposed in CVE-2025-54380?
CVE-2025-54380 exposes hashed global system account credentials when fetching mediapackage elements from mediapackage XML files.
Is CVE-2025-54380 a remote attack vector?
Yes, CVE-2025-54380 can be exploited remotely, making it crucial for affected users to apply the necessary updates.