Medium severity · published Nov 28, 2022
CVE-2022-41965
Opencast is a free, open-source platform to support the management of educational audio and video content
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opencast · Apereo
before 12.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41965
Patch
https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
Third Party Advisory
https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7
More from Opencast
10.0
CVE-2020-5206
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me…
8.8
CVE-2020-5222
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key
8.1
CVE-2020-5229
Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm
7.7
CVE-2021-43821
Opencast is an Open Source Lecture Capture & Video Management for Education
7.5
CVE-2024-52797
Opencast is free and open source software for automated video capture and distribution