org.opencastproject:opencast-kernel@7.4 vulnerabilities
latest version
16.8
latest non vulnerable version
first published
5 years ago
latest version published
11 days ago
licenses detected
- [0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.opencastproject:opencast-kernel package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.opencastproject:opencast-kernel is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Improper Input Validation due to disabling HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. How to fix Improper Input Validation? Upgrade | [,7.9)[8.0,8.9) |
org.opencastproject:opencast-kernel is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Improper Authorization. Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. How to fix Improper Authorization? Upgrade | [8.0,8.1)[,7.6) |
org.opencastproject:opencast-kernel is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Improper Authorization. Enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised. How to fix Improper Authorization? Upgrade | [8.0,8.1)[,7.6) |
org.opencastproject:opencast-kernel is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Privilege Escalation. Users with the role How to fix Privilege Escalation? Upgrade | [,7.6)[8.0,8.1) |