High severity · published Nov 17, 2017
CVE-2017-1000217
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in…
8.8
CVSS
1.9%
EPSS
No
On KEV
Description
Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opencast · Opencast
through 2.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-1000217
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-1000217
groups.google.com
https://groups.google.com/a/opencast.org/forum/#%21topic/security-notices/sCpt0pIPEFg
More from Opencast
8.8
CVE-2026-77614
Opencast: Session fixation in login enables account takeover via crafted link
8.7
CVE-2026-77615
Paella Player: Stored XSS via caption cue text
6.5
CVE-2025-54380
Opencast still publishes global system account credentials
5.4
CVE-2025-61788
Opencast Paella Player 7 vulnerable to Cross-Site-Scripting
5.3
CVE-2025-55202
Opencast has a partial path traversal vulnerability in UI config