CVE-2020-5231: OpenCasts - Users with ROLE_COURSE_ADMIN can create new users
Summary
CVE-2020-5231: Users with ROLE_COURSE_ADMIN can create new users in Opencast. Affects org.opencastproject:opencast-kernel across 2 version ranges.
< 7.6
>= 8.0, < 8.1
Fixed in 7.6 or 8.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenCasts is an open-source project that provides a platform for managing and publishing audiovisual content. It includes various components, such as the OpenCasts Kernel, which is responsible for core functionality. The OpenCasts Kernel is a Maven package that handles user management and security.
Vulnerability Detail
The vulnerability (CVE-2020-5231) allows users with the role ROLE_COURSE_ADMIN to create new users using the user-utils endpoint in OpenCasts. This role, which is not documented or referenced in the code except for tests, is a non-standard role that should not have the ability to create users. However, due to a security misconfiguration, users with this role can create new users without the ROLE_ADMIN role. This can lead to unauthorized user creation and potential misuse of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.67.6 -
>= 8.0, < 8.18.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, organizations can follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The vulnerability in OpenCasts allows users with the ROLE_COURSE_ADMIN role to create new users without the ROLE_ADMIN role, potentially leading to unauthorized user creation. It is crucial to update to the latest version of OpenCasts or manually remove the ROLE_COURSE_ADMIN role from the security configuration to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-kernel →
FAQ
The vulnerability allows users with the ROLE_COURSE_ADMIN role to create new users without the ROLE_ADMIN role. This can lead to unauthorized user creation and potential misuse of the system.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your OpenCasts installation is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is recommended to apply the necessary patches or updates to mitigate the risk.
Yes, organizations can manually remove all instances of the ROLE_COURSE_ADMIN role from their security configuration file (etc/security/mh_default_org.xml by default) to mitigate the vulnerability.
The recommended solution is to update to OpenCasts version 7.6 or 8.1, which include a new default security configuration. Manually removing the ROLE_COURSE_ADMIN role from the security configuration is also an alternative solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
