Opencast vulnerabilities

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path parameter and does not replace it when the victim logs in. An unauthenticated attacker can send a crafted link to a victim whose browser has no active Opencast session cookie, wait for the victim to authenticate, and then reuse the known identifier as the victim's authenticated session. This can expose the victim's data and actions and can produce full administrative account takeover when the victim is an administrator. This issue is fixed in versions 19.7 and 20.2.

Prior to Opencast 17.8 and 18.2, in some situations Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, possibly exposing internal media. The risk of actual impact is very low and requires a user with write access to an event using the editor and first clicking 'Save & Publish' before selecting 'Save'.

In Opencast prior to versions 17.8 and 18.2, the paella player renders user-supplied metadata (title, description, etc.) without filtering. This allows an attacker to inject malicious HTML and JavaScript that executes in the browsers of users viewing the media.

Opencast version 18.0 and versions before 17.7 have insufficient protections against path traversal attacks in the UI config module. The path is checked without checking for the file separator, potentially allowing access to files in another folder starting with the same path. This is fixed in versions 17.7 and 18.1.