CVE-2018-16153: Opencast publishes global system account credentials
Summary
CVE-2018-16153: Opencast publishes global system account credentials. Affects org.opencastproject:opencast-common versions < 10.6. Fixed in 10.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Opencast is an open-source system for automated video capture, processing, and distribution. It is widely used in educational institutions and organizations to manage and publish video content. The 'opencast-common' package is a core component of Opencast, providing common functionalities and services for the system. This package is written in Java and is managed using Maven.
Vulnerability Detail
The vulnerability in Opencast before version 10.6 allows the publication of global system account credentials. When accessing files in a media package, Opencast tries to authenticate against any external services listed, sending the global system user's credentials. This authentication attempt occurs regardless of whether the target is part of the Opencast cluster or not. While previous mitigations prevented clear text authentications, hashed credentials could still be compromised with enough malicious intent. This vulnerability poses a risk of unauthorized access to external services and potential exposure of sensitive information.
How To Fix
Latest published version: 18.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround is available for this vulnerability. It is necessary to apply the patch or upgrade to the fixed version of Opencast to address the issue.
Conclusion
The vulnerability in Opencast that allowed the publication of global system account credentials has been addressed in version 10.6. Upgrading to this version or later ensures that authentication requests are only sent to trusted servers within the Opencast cluster, mitigating the risk of unauthorized access to external services. It is recommended to promptly apply the patch or upgrade to protect the system from potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-common →
FAQ
Opencast is an open-source system for automated video capture, processing, and distribution. It is commonly used in educational institutions and organizations to manage and publish video content.
The 'opencast-common' package is a core component of Opencast, providing common functionalities and services for the system. It is written in Java and managed using Maven.
This vulnerability allows the publication of global system account credentials, which can lead to unauthorized access to external services and potential exposure of sensitive information.
To fix this vulnerability, you should upgrade to Opencast version 10.6 or later. This version ensures that authentication requests are only sent to servers within the Opencast cluster, preventing exposure of global system account credentials.
No, there is no workaround available. It is necessary to apply the patch or upgrade to the fixed version of Opencast.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-common.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
