Opencast publishes global system account credentials

Also known as GHSA-hcxx-mp6g-6gr9

Published 4 y ago 2021-12-14 · modified 59 d ago 2026-09-10 · JSON

CVSS

7.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.8%

percentile 58%

Public exploits

none known

An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 y ago 2023-12-18

Exploit prediction (EPSS)

0.83% probability of exploitation in the next 30 days, higher than 58% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
CNA	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
GitHub	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.opencastproject:opencast-common`	<10.6	10.6

Classification

Weakness

CWE-522 Insufficiently Protected Credentials
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

apereo.org /projects/opencast/news · x_transferred
github.com /advisories/GHSA-hcxx-mp6g-6gr9 · x_transferred
github.com /opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51 · x_transferred
docs.opencast.org /r/10.x/admin/#changelog · x_transferred
github.com /opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9 · web
nvd.nist.gov /vuln/detail/CVE-2018-16153 · advisory
docs.opencast.org /r/10.x/admin/#changelog/#opencast-106 · web
github.com /opencast/opencast · package

Sources

CVE List: CVE-2018-16153
GitHub Advisory: GHSA-hcxx-mp6g-6gr9
NVD: CVE-2018-16153

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary