CVE-2020-5228: Unauthenticated Access Via OAI-PMH in org.opencastproject:opencast-oaipmh-api
Summary
CVE-2020-5228: Unauthenticated Access Via OAI-PMH. Affects org.opencastproject:opencast-oaipmh-api across 2 version ranges.
< 7.6
>= 8.0, < 8.1
Fixed in 7.6 or 8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.opencastproject:opencast-oaipmh-api package is a component of the Opencast project, an open-source platform for managing and publishing audiovisual content. It provides functionality for media publication via OAI-PMH (Open Archives Initiative Protocol for Metadata Harvesting). OAI-PMH allows for the retrieval of metadata and media resources from Opencast. However, due to a vulnerability, unauthenticated public access is granted to all media and metadata by default, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability (CVE-2020-5228) arises from the default configuration of OAI-PMH in Opencast. By default, OAI-PMH is activated and allows unauthenticated access to media and metadata. This means that anyone can access and retrieve media resources without any authentication or authorization. This can lead to unintended public access to events and media content without the knowledge of the users. The impact of this vulnerability is significant as it compromises the confidentiality and privacy of the media and metadata stored in Opencast.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.67.6 -
>= 8.0, < 8.18.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the recommended versions is not immediately feasible, a workaround can be implemented by modifying the organization security configuration file 'etc/security/mh_default_org.xml'. In this file, the roles required for accessing '/oaipmh' can be changed from 'ROLE_ANONYMOUS' to 'ROLE_ADMIN'. This will restrict access to the OAI-PMH endpoint to only users with administrative privileges.
Conclusion
The vulnerability (CVE-2020-5228) in the org.opencastproject:opencast-oaipmh-api package allows unauthenticated access to media and metadata in Opencast. To mitigate this vulnerability, it is recommended to update to Opencast version 7.6 or 8.1, or modify the organization security configuration. Additional access controls can also be implemented at the network or infrastructure level. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-oaipmh-api →
FAQ
The impact of this vulnerability is that unauthenticated users can access and retrieve media and metadata from Opencast, potentially exposing sensitive information without the knowledge of the users.
To fix this vulnerability, update to Opencast version 7.6 or 8.1. Alternatively, modify the organization security configuration file to restrict access to the OAI-PMH endpoint.
OAI-PMH (Open Archives Initiative Protocol for Metadata Harvesting) is a protocol for sharing metadata and resources between repositories. In Opencast, it is used for media publication and retrieval.
Yes, starting from Opencast version 9, OAI-PMH publication is removed from the default workflow. Users have to update their workflows to enable OAI-PMH publication.
Yes, if updating to the recommended versions or modifying the security configuration is not feasible, additional access controls can be implemented at the network or infrastructure level to restrict access to the OAI-PMH endpoint.
