Vulnerability · Published Jan 30, 2020 · Assigned by GitHub_M
CVE-2020-5222Hard-Coded Key Used For Remember-me Token in OpenCast
Medium 6.8
In plain English
A medium-severity hard-coded credentials in opencast from opencast. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.opencastproject:opencast-kernel | 7.6 | GHSA-mh8g-hprg-8363 |
| Maven | org.opencastproject:opencast-kernel | 8.1 | GHSA-mh8g-hprg-8363 |
Affected products (as reported)
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N