CVE-2021-43807: HTTP Method Spoofing in org.opencastproject:opencast-common
Summary
CVE-2021-43807: HTTP Method Spoofing. Affects org.opencastproject:opencast-common versions < 9.10. Fixed in 9.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.opencastproject:opencast-common is a Maven package that is part of the Opencast project. Opencast is an open-source system for managing and distributing audiovisual content. The opencast-common package provides common functionality used across the Opencast system. This package is vulnerable to HTTP method spoofing, which allows attackers to change the assumed HTTP method via a URL parameter. This can lead to unauthorized changes to the server state and facilitate cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in org.opencastproject:opencast-common versions prior to 9.10 allows HTTP method spoofing, enabling attackers to modify the assumed HTTP method through a URL parameter. This means that attackers can convert HTTP GET requests into PUT requests or use an HTTP form to send DELETE requests. By bypassing the restrictions on these types of requests, attackers can perform actions that would otherwise be restricted and launch CSRF attacks. For example, an attacker can craft a GET request that creates a new user, which can be executed if an admin is logged in and accidentally clicks on a malicious link.
How To Fix
Latest published version: 18.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.10
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to set the SameSite=Strict attribute for cookies. This can help mitigate the issue, but it may not be a comprehensive solution depending on the system's integrations. It is strongly recommended to update to the patched versions of Opencast to fully address the vulnerability.
Conclusion
The vulnerability in org.opencastproject:opencast-common versions prior to 9.10 allows HTTP method spoofing, enabling attackers to perform unauthorized actions and launch CSRF attacks. To fix this vulnerability, it is crucial to update to Opencast versions 9.10 or 10.0. Additionally, setting the SameSite=Strict attribute for cookies can provide some mitigation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-common →
FAQ
HTTP method spoofing is a technique where an attacker manipulates the HTTP method used in a request by modifying a URL parameter. This allows them to bypass restrictions and perform actions that would otherwise be restricted.
Opencast is an open-source system for managing and distributing audiovisual content. It provides tools for recording, processing, managing, and publishing video and audio content.
An attacker can craft a malicious link or form that includes a URL parameter to modify the assumed HTTP method. If a user with sufficient privileges clicks on the link or submits the form, the server state can be changed, leading to unauthorized actions.
The vulnerability allows attackers to perform actions that would otherwise be restricted, such as creating new users or modifying server state. This can lead to unauthorized changes, data breaches, or other malicious activities.
Setting the SameSite=Strict attribute for cookies can help mitigate the vulnerability. However, it is strongly recommended to update to the patched versions of Opencast to fully address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-common.
