Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yM3FyLXZ3dmctNDNmN84AAwGL

Authenticated OpenRedirect Vulnerability

Description
Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.

Impact
The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.

Patches
This issue is fixed in Opencast 12.5 and newer

References
Patch fixing the issue

If you have any questions or comments about this advisory:
Open an issue in our issue tracker
Email us at [email protected]

Permalink: https://github.com/advisories/GHSA-r3qr-vwvg-43f7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yM3FyLXZ3dmctNDNmN84AAwGL
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: almost 2 years ago

CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-r3qr-vwvg-43f7, CVE-2022-41965
References:

• https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7
• https://nvd.nist.gov/vuln/detail/CVE-2022-41965
• https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
• https://github.com/advisories/GHSA-r3qr-vwvg-43f7

Repository: https://github.com/opencast/opencast
Blast Radius: 9.6

Affected Packages