TI-2020-04284 Aliases CVE-2020-5228 GHSA-6f54-3qr9-pjgj

Opencast allows unauthorized public access via OAI-PMH

LOW 35CWE-862Published 2020-01-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

Why it matters now

EPSS 0.00977 62nd percentileScored 2026-11-07

Fix Fixed opencast (opencast): 7.6, 8.1org.opencastproject:opencast-oaipmh-api (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 7.6; 8.0 to before 8.1	7.6, 8.1	Patch available	CNA
—	org.opencastproject:opencast-oaipmh-api (Maven)	before 7.6	7.6	Patch available	GHSA-6f54-3qr9-pjgj
—	org.opencastproject:opencast-oaipmh-api (Maven)	8.0 to before 8.1	8.1	Patch available	GHSA-6f54-3qr9-pjgj

opencast Vendoropencast Affected before 7.6; 8.0 to before 8.1 Fixed in 7.6, 8.1 Patch available CNA
org.opencastproject:opencast-oaipmh-api (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-6f54-3qr9-pjgj
org.opencastproject:opencast-oaipmh-api (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-6f54-3qr9-pjgj

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 7.6	Vulnerable	Apereo
cpe:2.3:a:apereo:opencast:8.0:::::::*	8.0	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Apereo
cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 7.6, 8.1
Fix · GHSA-6f54-3qr9-pjgj org.opencastproject:opencast-oaipmh-api (Maven) Fixed in 7.6 Advisory →
Fix · GHSA-6f54-3qr9-pjgj org.opencastproject:opencast-oaipmh-api (Maven) Fixed in 8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5228
2026-10-03 Alias added: GHSA-6f54-3qr9-pjgj

References

Patch 1

https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276

Advisory 2

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences