{"id":"CVE-2018-16153","published":"2023-12-12T00:00:00Z","modified":"2025-05-27T14:35:51Z","title":"An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00829,"percentile":0.57496,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://www.apereo.org/projects/opencast/news","tags":[]},{"url":"https://github.com/advisories/GHSA-hcxx-mp6g-6gr9","tags":[]},{"url":"https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","tags":[]},{"url":"https://docs.opencast.org/r/10.x/admin/#changelog","tags":[]}],"priority":{"score":16.7,"factors":[{"name":"EPSS percentile","points":11.5},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"Maven","package":"org.opencastproject:opencast-common","vulnerableRanges":["<10.6"],"patched":["10.6"],"from":["GHSA-hcxx-mp6g-6gr9"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2529","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencast-cve-2021-43821","parents":[{"from":"CVE-2021-43821","to":"CVE-2018-16153","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764"],"basis":"shared function","functions":["addContentToRepo"]}]},{"from":"CVE-2022-29237","to":"CVE-2018-16153","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7"],"basis":"shared function","functions":["addContentToRepo"]}]}],"children":[{"from":"CVE-2018-16153","to":"CVE-2025-54380","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-hcxx-mp6g-6gr9","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-j63h-hmgw-x4j7","via":"reference","url":"https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9"},{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6"],"basis":"shared function","functions":["addContentToRepo","getOrganizationDirectoryService"]}]}]}}