CVE-2020-5230

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317	Patch
https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmq	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apereo:opencast::::::::
	cpe:2.3:a:apereo:opencast:8.0:::::::*

History

No history.

Information

Published : 2020-01-30 21:15

Updated : 2023-12-10 13:13

NVD link : CVE-2020-5230

Mitre link : CVE-2020-5230

CVE.ORG link : CVE-2020-5230

JSON object : View

Products Affected

apereo

opencast

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

{"id": "CVE-2020-5230", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.3}]}, "published": "2020-01-30T21:15:15.167", "references": [{"url": "https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmq", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-74"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-99"}]}], "descriptions": [{"lang": "en", "value": "Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(\u2026) vs Id.compact(\u2026) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1."}, {"lang": "es", "value": "Opencast anterior a las versiones 8.1 y 7.6 permite utilizar identificadores casi arbitrarios para paquetes y elementos de medios. Esto puede ser problem\u00e1tico para la operaci\u00f3n y la seguridad, ya que tales identificadores a veces se usan para las operaciones del sistema de archivos, lo que puede llevar a un atacante a escapar de directorios de trabajo y escribir archivos en otras ubicaciones. Adem\u00e1s, el comportamiento Id.toString (...) vs Id.compact (...) de Opencast, este \u00faltimo tratando de mitigar algunos de los problemas del sistema de archivos, puede causar errores debido a la falta de coincidencia del identificador ya que un identificador puede cambiar involuntariamente. Este problema se soluciona en Opencast 7.6 y 8.1."}], "lastModified": "2020-02-10T21:55:25.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7056094F-6E63-4BFB-B8A3-125746BA882C", "versionEndExcluding": "7.6"}, {"criteria": "cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A82AABB-ACF6-4017-99E8-4DA90CE416D7"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}