CVE-2020-26234

Katalog CVE

CVSS 4.8 · Medium EPSS 0,28%

Kerentanan Origin Validation Error pada apereo opencast. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.

Rincian

Terbit di NVD

8 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opencast/opencast/commit/4225bf90af74557deaf8fb6b80b0705c9621acfc patch · advisory pihak ketiga
• https://github.com/opencast/opencast/security/advisories/GHSA-44cw-p2hm-gpf6 advisory pihak ketiga