Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Authentication Bypass For Endpoints With Anonymous Access in OpenCast
Vulnerability Description
In Opencast before 7.6 and 8.1, using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication. This problem is fixed in Opencast 7.6 and Opencast 8.1
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Vulnerability Type
授权机制不恰当
Vulnerability Title
Apereo Opencast 授权问题漏洞
Vulnerability Description
Opencast是Opencast组织的一款用于大规模自动视频捕获，管理和分发的直播视频支撑软件。 Apereo Opencast 7.6之前版本和8.1之前版本中存在授权问题漏洞。攻击者可利用该漏洞绕过访问限制。
CVSS Information
N/A
Vulnerability Type
N/A