What is CVE-2022-41965?

CVE-2022-41965 is a medium-severity vulnerability in Apereo Opencast, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.7/10. Published 2022-11-28.

How severe is CVE-2022-41965?

Medium severity. CVSS v3 base score is 5.7 out of 10.

Open Redirect in Apereo Opencast

CVE-2022-41965

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.

Vulnerability class: Open Redirect

EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N.

Affected products

Apereo Opencast
Opencast — versions < 12.5

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

security-advisories@github.com (Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory)

Frequently asked questions

What is CVE-2022-41965?: CVE-2022-41965 is a medium-severity vulnerability in Apereo Opencast, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.7/10. Published 2022-11-28.
How severe is CVE-2022-41965?: Medium severity. CVSS v3 base score is 5.7 out of 10.