CVE-2020-5206

Katalog CVE

CVSS 10.0 · Critical EPSS 1,3%

Kerentanan Improper Authorization pada apereo opencast. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1

Rincian

Terbit di NVD

30 Januari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-287: Improper Authentication

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opencast/opencast/commit/b157e1fb3b35991ca7bf59f0730329fbe7ce82e8 patch
• https://github.com/opencast/opencast/security/advisories/GHSA-vmm6-w4cf-7f3x mitigasi · advisory pihak ketiga