Open Redirect in Apereo Opencast
CVE-2022-41965
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.004 (29.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.004 · change: +0.000
Affected products
- Apereo Opencast
- Opencast — versions < 12.5
Weakness classification (CWE)
References
- github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7 (Third Party Advisory)
- github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017 (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-41965?
- CVE-2022-41965 is a medium-severity vulnerability in Apereo Opencast, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.7/10. Published 2022-11-28.
- How severe is CVE-2022-41965?
- Medium severity. CVSS v3 base score is 5.7 out of 10.