org.opencastproject:base@18.5

latest version

18.5

first published

7 years ago

latest version published

7 months ago

licenses detected

ECL-2.0
[6.6,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.opencastproject:base package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
H Session Fixation org.opencastproject:base is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Session Fixation via URL-based `jsessionid` handling in the Spring Security HTTP configuration in `etc/security/mh_default_org.xml`. An attacker can hijack a victim’s authenticated session by sending a crafted link with an attacker-chosen `;jsessionid=` value and luring the victim to log in through it. Because the application accepts the session id from the URL when no cookie is present and keeps that identifier after authentication, the attacker’s chosen session becomes bound to the victim’s logged-in account. This lets an unauthenticated attacker ride the victim’s session after login, including taking over an administrator account and accessing the victim’s data and actions. How to fix Session Fixation? Upgrade `org.opencastproject:base` to version 19.7, 20.2 or higher.	[,19.7)[20.0,20.2)

Session Fixation

org.opencastproject:base is a free and open source solution for automated video capture and distribution at scale.

Affected versions of this package are vulnerable to Session Fixation via URL-based jsessionid handling in the Spring Security HTTP configuration in etc/security/mh_default_org.xml. An attacker can hijack a victim’s authenticated session by sending a crafted link with an attacker-chosen ;jsessionid= value and luring the victim to log in through it. Because the application accepts the session id from the URL when no cookie is present and keeps that identifier after authentication, the attacker’s chosen session becomes bound to the victim’s logged-in account. This lets an unauthenticated attacker ride the victim’s session after login, including taking over an administrator account and accessing the victim’s data and actions.

How to fix Session Fixation?

Upgrade org.opencastproject:base to version 19.7, 20.2 or higher.

[,19.7)[20.0,20.2)

Go back to all versions of this package