Vulnerability in Apereo Opencast
CVE-2021-43821
Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast before version 9.10 or 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface. Before Opencast 9.10 and 10.6, Opencast would open and include local files during ingests. Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine. An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given. The issue has been fixed in Opencast 10.6 and 11.0. You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.020 (79.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 80th percentile — 79.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.020 · change: 0.000
Affected products
- Apereo Opencast
- Opencast — versions < 10.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/opencast/opencast/security/advisories/GHSA-59g4-hpg3-3gcp (Exploit, Third Party Advisory)
- github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764 (Patch, Third Party Advisory)
- github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modu… (Patch, Third Party Advisory)
- mvnrepository.com/artifact/org.opencastproject/opencast-ingest-service-impl (Third Party Advisory)
Frequently asked questions
- What is CVE-2021-43821?
- CVE-2021-43821 is a critical-severity vulnerability in Apereo Opencast, classified under Files or Directories Accessible to External Parties. CVSS score: 9.9/10. Published 2021-12-14.
- How severe is CVE-2021-43821?
- Critical severity. CVSS v3 base score is 9.9 out of 10.
- Is CVE-2021-43821 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.