Read the docs
TI-2020-04286 Aliases CVE-2020-5230GHSA-w29m-fjp4-qhmq

Opencast uses unsafe identifiers

Priority LOW 36CWE-99Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.

Why it matters now

EPSS 0.01168 67th percentileScored 2026-11-07
Fix Fixed opencast (opencast): 7.6, 8.1org.opencastproject:base (Maven): 7.6, 8.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencastopencastbefore 7.6; 8.0 to before 8.17.6, 8.1Patch availableCNA
—org.opencastproject:base (Maven)before 7.67.6Patch availableGHSA-w29m-fjp4-qhmq
—org.opencastproject:base (Maven)8.0 to before 8.18.1Patch availableGHSA-w29m-fjp4-qhmq
  • opencast Vendoropencast Affected before 7.6; 8.0 to before 8.1 Fixed in 7.6, 8.1 Patch available CNA
  • org.opencastproject:base (Maven) Vendor— Affected before 7.6 Fixed in 7.6 Patch available GHSA-w29m-fjp4-qhmq
  • org.opencastproject:base (Maven) Vendor— Affected 8.0 to before 8.1 Fixed in 8.1 Patch available GHSA-w29m-fjp4-qhmq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*before 7.6VulnerableApereo
cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:*8.0VulnerableApereo
  • cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 7.6 Vulnerable ·Apereo
  • cpe:2.3:a:apereo:opencast:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Apereo

Remediation

  • Fix · CNA opencast (opencast) Fixed in 7.6, 8.1
  • Fix · GHSA-w29m-fjp4-qhmq org.opencastproject:base (Maven) Fixed in 7.6 Advisory →
  • Fix · GHSA-w29m-fjp4-qhmq org.opencastproject:base (Maven) Fixed in 8.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5230
  2. 2026-10-03 Alias added: GHSA-w29m-fjp4-qhmq

References

Patch 1

Advisory 2

  • TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
  • TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
  • TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
  • TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
  • TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
  • TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences