CVE-2025-55202

Katalog CVE

CVSS 5.3 · Medium EPSS 0,39%

Kerentanan Relative Path Traversal pada apereo opencast. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder.

Rincian

Terbit di NVD

29 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/opencast/opencast/commit/e2cc65d6fbe052ebb71d9f6b583bb54b181af009 patch
• https://github.com/opencast/opencast/pull/6979 patch
• https://github.com/opencast/opencast/security/advisories/GHSA-hq8m-v68g-8cf8 advisory pihak ketiga