TI-2020-04285 Aliases CVE-2020-5229 GHSA-h362-m8f2-5x7c

Opencast stores passwords using outdated MD5 hash algorithm

LOW 36CWE-327Published 2020-01-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default `admin` user. This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access to these hashes. Note that attackers needing access to the hashes means that they must gain access to the database in which these are stored first to be able to start cracking the passwords. The problem is addressed in Opencast 8.1 which now uses the modern and much stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until the password is updated. For a list of users whose password hashes are stored using MD5, take a look at the `/user-utils/users/md5.json` REST endpoint.

Why it matters now

EPSS 0.00626 50th percentileScored 2026-11-07

Fix Fixed opencast (opencast): 8.1org.opencastproject:opencast-common-jpa-impl (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
opencast	opencast	before 8.1	8.1	Patch available	CNA
—	org.opencastproject:opencast-common-jpa-impl (Maven)	before 7.6	7.6	Patch available	GHSA-h362-m8f2-5x7c
—	org.opencastproject:opencast-common-jpa-impl (Maven)	8.0 to before 8.1	8.1	Patch available	GHSA-h362-m8f2-5x7c

opencast Vendoropencast Affected before 8.1 Fixed in 8.1 Patch available CNA
org.opencastproject:opencast-common-jpa-impl (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-h362-m8f2-5x7c
org.opencastproject:opencast-common-jpa-impl (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-h362-m8f2-5x7c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apereo:opencast::::::::	before 8.1	Vulnerable	Apereo

cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 8.1 Vulnerable ·Apereo

Remediation

Fix · CNA opencast (opencast) Fixed in 8.1
Fix · GHSA-h362-m8f2-5x7c org.opencastproject:opencast-common-jpa-impl (Maven) Fixed in 7.6 Advisory →
Fix · GHSA-h362-m8f2-5x7c org.opencastproject:opencast-common-jpa-impl (Maven) Fixed in 8.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-5229
2026-10-03 Alias added: GHSA-h362-m8f2-5x7c
2026-10-31 EPSS moved to the 50th–90th percentile
2026-11-02 EPSS moved to the below the 50th percentile
2026-11-03 EPSS moved to the 50th–90th percentile

References

Patch 1

https://github.com/opencast/opencast/commit/32bfbe5f78e214e2d589f92050228b91d704758e

Advisory 2

TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8

See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences