Vulnerability Details CVE-2020-5222
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 49.2%
CVSS Severity
CVSS v3 Score 6.8
CVSS v2 Score 6.5
References
- https://github.com/opencast/opencast/commit/1a7172c95af8d542a77ae5b153e4c834dd4788a6
- https://github.com/opencast/opencast/security/advisories/GHSA-mh8g-hprg-8363
- https://github.com/opencast/opencast/commit/1a7172c95af8d542a77ae5b153e4c834dd4788a6
- https://github.com/opencast/opencast/security/advisories/GHSA-mh8g-hprg-8363
Products affected by CVE-2020-5222
-
cpe:2.3:a:apereo:opencast:1.3.0
-
cpe:2.3:a:apereo:opencast:1.3.1
-
cpe:2.3:a:apereo:opencast:1.4
-
cpe:2.3:a:apereo:opencast:1.4.1
-
cpe:2.3:a:apereo:opencast:1.4.2
-
cpe:2.3:a:apereo:opencast:1.4.3
-
cpe:2.3:a:apereo:opencast:1.4.4
-
cpe:2.3:a:apereo:opencast:1.5.0
-
cpe:2.3:a:apereo:opencast:1.5.1
-
cpe:2.3:a:apereo:opencast:1.6.0
-
cpe:2.3:a:apereo:opencast:1.6.1
-
cpe:2.3:a:apereo:opencast:1.6.2
-
cpe:2.3:a:apereo:opencast:1.6.3
-
cpe:2.3:a:apereo:opencast:2.0.0
-
cpe:2.3:a:apereo:opencast:2.0.1
-
cpe:2.3:a:apereo:opencast:2.0.2
-
cpe:2.3:a:apereo:opencast:2.1.0
-
cpe:2.3:a:apereo:opencast:2.1.1
-
cpe:2.3:a:apereo:opencast:2.1.2
-
cpe:2.3:a:apereo:opencast:2.2.0
-
cpe:2.3:a:apereo:opencast:2.2.1
-
cpe:2.3:a:apereo:opencast:2.2.2
-
cpe:2.3:a:apereo:opencast:2.2.3
-
cpe:2.3:a:apereo:opencast:2.2.4
-
cpe:2.3:a:apereo:opencast:2.2.5
-
cpe:2.3:a:apereo:opencast:2.3.0
-
cpe:2.3:a:apereo:opencast:2.3.1
-
cpe:2.3:a:apereo:opencast:2.3.2
-
cpe:2.3:a:apereo:opencast:2.3.3
-
cpe:2.3:a:apereo:opencast:2.3.4
-
cpe:2.3:a:apereo:opencast:2.3.5
-
cpe:2.3:a:apereo:opencast:3.0
-
cpe:2.3:a:apereo:opencast:3.1
-
cpe:2.3:a:apereo:opencast:3.2
-
cpe:2.3:a:apereo:opencast:3.3
-
cpe:2.3:a:apereo:opencast:3.4
-
cpe:2.3:a:apereo:opencast:3.5
-
cpe:2.3:a:apereo:opencast:3.6
-
cpe:2.3:a:apereo:opencast:3.7
-
cpe:2.3:a:apereo:opencast:4.0
-
cpe:2.3:a:apereo:opencast:4.1
-
cpe:2.3:a:apereo:opencast:4.2
-
cpe:2.3:a:apereo:opencast:4.3
-
cpe:2.3:a:apereo:opencast:4.4
-
cpe:2.3:a:apereo:opencast:4.5
-
cpe:2.3:a:apereo:opencast:5.0
-
cpe:2.3:a:apereo:opencast:5.1
-
cpe:2.3:a:apereo:opencast:5.2
-
cpe:2.3:a:apereo:opencast:5.3
-
cpe:2.3:a:apereo:opencast:5.4
-
cpe:2.3:a:apereo:opencast:5.5
-
cpe:2.3:a:apereo:opencast:6.0
-
cpe:2.3:a:apereo:opencast:6.1
-
cpe:2.3:a:apereo:opencast:6.2
-
cpe:2.3:a:apereo:opencast:6.3
-
cpe:2.3:a:apereo:opencast:6.4
-
cpe:2.3:a:apereo:opencast:6.5
-
cpe:2.3:a:apereo:opencast:6.6
-
cpe:2.3:a:apereo:opencast:6.7
-
cpe:2.3:a:apereo:opencast:7.0
-
cpe:2.3:a:apereo:opencast:7.1
-
cpe:2.3:a:apereo:opencast:7.2
-
cpe:2.3:a:apereo:opencast:7.3
-
cpe:2.3:a:apereo:opencast:7.4
-
cpe:2.3:a:apereo:opencast:7.5
-
cpe:2.3:a:apereo:opencast:8.0