GHSA-qwfv-5jwj-582h

Opencast RCE Vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000217

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.opencastproject:base	< 2.3.3	2.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-1000217 advisory
https://github.com/opencast/opencast/commit/2d42e42f3cfcff3a775a2538f735fca8542ce1fc web
https://github.com/opencast/opencast/commit/fba2f35df24ce2aeaff627200065cbade9b3a0cd web
https://github.com/opencast/opencast package
https://groups.google.com/a/opencast.org/forum/#!topic/security-notices/sCpt0pIPEFg web