org.opencastproject:opencast-oaipmh-api@7.3 vulnerabilities
latest version
16.8
latest non vulnerable version
first published
5 years ago
latest version published
1 months ago
licenses detected
- [0,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.opencastproject:opencast-oaipmh-api package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.opencastproject:opencast-oaipmh-api is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to XML External Entity (XXE) Injection. An attacker could easily execute a (seemingly permanent) denial of service attack via a billion laughs attack (XML bomb). To exploit this, users need to have ingest privileges, limiting the group of potential attackers. How to fix XML External Entity (XXE) Injection? Upgrade | [,9.6) |
org.opencastproject:opencast-oaipmh-api is a free and open source solution for automated video capture and distribution at scale. Affected versions of this package are vulnerable to Missing Authorization. Impact Media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. How to fix Missing Authorization? Upgrade | [8.0,8.1)[,7.6) |