https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:55:15 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-12676 cnvd-2020-12676 https://cve.radiocsirt.org/vuln/cnvd-2020-12676 https://cve.radiocsirt.org/vuln/euvd-2026-36424 EUVD-2026-36424 https://cve.radiocsirt.org/vuln/euvd-2026-36424 https://cve.radiocsirt.org/vuln/fkie_cve-2020-5206 <p>In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1</p> <p>In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-5206 https://cve.radiocsirt.org/vuln/ghsa-vmm6-w4cf-7f3x <p><strong>Affected:</strong> Maven: org.opencastproject:opencast-kernel</p> <p>### Impact</p> <p>Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access.</p> <p>This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.</p> <p>### Patches</p> <p>This problem is fixed in Opencast 7.6 and Opencast 8.1</p> <p>### Workarounds</p> <p>As a workaround for older, unpatched versions, disabling remember-me cookies in `etc/security/mh_default_org.xml` will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:</p> <p>```xml &lt;sec:remember-me … /&gt; ```</p> <p>### References</p> <p>- [Remember-me cookie in the security configuration file](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues) - For security-relevant information, email us at security@opencast.org</p> <p><strong>Affected:</strong> Maven: org.opencastproject:opencast-kernel</p> <p>### Impact</p> <p>Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access.</p> <p>This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.</p> <p>### Patches</p> <p>This problem is fixed in Opencast 7.6 and Opencast 8.1</p> <p>### Workarounds</p> <p>As a workaround for older, unpatched versions, disabling remember-me cookies in `etc/security/mh_default_org.xml` will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:</p> <p>```xml &lt;sec:remember-me … /&gt; ```</p> <p>### References</p> <p>- [Remember-me cookie in the security configuration file](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues) - For security-relevant information, email us at security@opencast.org</p> https://cve.radiocsirt.org/vuln/ghsa-vmm6-w4cf-7f3x https://cve.radiocsirt.org/vuln/gsd-2020-5206 gsd-2020-5206 https://cve.radiocsirt.org/vuln/gsd-2020-5206