gsd-2022-41965
Vulnerability from gsd
Modified
2023-12-13 01:19
Details
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
Aliases
Aliases
CVE-2022-41965


To clipboard 

{
  "GSD": {
    "alias": "CVE-2022-41965",
    "id": "GSD-2022-41965"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-41965"
      ],
      "details": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
      "id": "GSD-2022-41965",
      "modified": "2023-12-13T01:19:32.891611Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-41965",
        "STATE": "PUBLIC",
        "TITLE": "Opencast Authenticated OpenRedirect Vulnerability"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "opencast",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 12.5"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "opencast"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "refsource": "CONFIRM",
            "url": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7"
          },
          {
            "name": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017",
            "refsource": "MISC",
            "url": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-r3qr-vwvg-43f7",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-common",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "eaef266d-6d26-401a-a5fa-f49b735c7e5c"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-ingest-service-impl",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "4d8a2d8b-332c-401a-a943-c352e4335429"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-kernel",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "68c0e831-e274-4379-a1bf-ee401fb01400"
        },
        {
          "affected_range": "(,12.5)",
          "affected_versions": "All versions before 12.5",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2022-12-01",
          "description": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.",
          "fixed_versions": [
            "12.5"
          ],
          "identifier": "CVE-2022-41965",
          "identifiers": [
            "CVE-2022-41965",
            "GHSA-r3qr-vwvg-43f7"
          ],
          "not_impacted": "",
          "package_slug": "maven/org.opencastproject/opencast-search-service-impl",
          "pubdate": "2022-11-28",
          "solution": "Upgrade to version 12.5 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-41965",
            "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
            "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
          ],
          "uuid": "26209699-16c2-49a7-b760-d65ae75d6066"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "12.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-41965"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast\u0027s Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one\u0027s Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7"
            },
            {
              "name": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-12-01T23:14Z",
      "publishedDate": "2022-11-28T21:15Z"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.