WaratekVRT Sign in

Org.opencastproject Opencast-kernel CVEs

7 CVEs, 1 protected by Waratek

Reset
More filters (2)
Columns
Vendor org.opencastproject✕Product opencast-kernel✕
Overview 7 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 1protected14.3% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 14.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 85.7%
Critical 1 14.3% High 2 28.6% Medium 4 57.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 14.3% partly blocked 0 0.0% not blocked 6 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 4 / year
No exploit published: 6Protected by Waratek: 1 Medium: 4High: 2Critical: 1 not blocked: 6blocked by ARMR today: 1 No public exploit: 7
20171 No exploit published1 Medium1 not blocked1 No public exploit1 20180 20190 20204 No exploit published4 Critical1 High1 Medium2 not blocked4 No public exploit4 20211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20220 20230 20240 20251 No exploit published1 Medium1 not blocked1 No public exploit1
201720182019202020212022202320242025
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-54380 Medium 2025-07-26 No exploit published No public exploit Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.
CVE-2021-32623 High 2021-06-16 Protected by Waratek No public exploit Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.
CVE-2020-26234 Medium 2020-12-08 No exploit published No public exploit Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate.
CVE-2020-5231 Medium 2020-01-30 No exploit published No public exploit In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.
CVE-2020-5222 High 2020-01-30 No exploit published No public exploit Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
CVE-2020-5206 Critical 2020-01-30 No exploit published No public exploit In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
CVE-2017-1000221 Medium 2017-11-17 No exploit published No public exploit In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X.