GSD-2022-41965

Vulnerability from gsd - Updated: 2023-12-13 01:19
Details
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
Aliases
Aliases
CVE-2022-41965
To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-41965",
    "id": "GSD-2022-41965"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-41965"
      ],
      "details": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
      "id": "GSD-2022-41965",
      "modified": "2023-12-13T01:19:32.891611Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-41965",
        "STATE": "PUBLIC",
        "TITLE": "Opencast Authenticated OpenRedirect Vulnerability"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "opencast",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 12.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "opencast"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "refsource": "CONFIRM",
            "url": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7"
          },
          {
            "name": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017",
            "refsource": "MISC",
            "url": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-r3qr-vwvg-43f7",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-common",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "eaef266d-6d26-401a-a5fa-f49b735c7e5c"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-ingest-service-impl",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "4d8a2d8b-332c-401a-a943-c352e4335429"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-kernel",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "68c0e831-e274-4379-a1bf-ee401fb01400"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-search-service-impl",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "26209699-16c2-49a7-b760-d65ae75d6066"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-41965"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7"
            },
            {
              "name": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-12-01T23:14Z",
      "publishedDate": "2022-11-28T21:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.