CVE-2020-5228
Description
Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.
How to fix
- apereo opencast7.6 or later
- org.opencastproject:opencast-oaipmh-api7.6, 8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apereo opencast | v < 7.6, 8.0 | 7.6 |
| org.opencastproject:opencast-oaipmh-apiMaven | v < 7.6, 8.0 ≤ v < 8.1 | 7.6, 8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.