{"id":"CVE-2025-54380","published":"2025-07-26T03:28:25Z","modified":"2025-07-28T19:00:02Z","title":"Opencast still publishes global system account credentials","vendor":"opencast","product":"opencast","tier":"tail","description":{"text":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00429,"percentile":0.37147,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-j63h-hmgw-x4j7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9","tags":["x_refsource_MISC"]},{"url":"https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","tags":["x_refsource_MISC"]}],"priority":{"score":12.0,"factors":[{"name":"EPSS percentile","points":7.43},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"opencast","affectedVersions":[{"vendor":"opencast","product":"opencast","versions":["< 17.6"]}],"affected":[{"ecosystem":"Maven","package":"org.opencastproject:opencast-common","vulnerableRanges":["<17.6"],"patched":["17.6"],"from":["GHSA-j63h-hmgw-x4j7"],"provenance":"source"},{"ecosystem":"Maven","package":"org.opencastproject:opencast-ingest-service-impl","vulnerableRanges":["<17.6"],"patched":["17.6"],"from":["GHSA-j63h-hmgw-x4j7"],"provenance":"source"},{"ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","vulnerableRanges":["<17.6"],"patched":["17.6"],"from":["GHSA-j63h-hmgw-x4j7"],"provenance":"source"},{"ecosystem":"Maven","package":"org.opencastproject:opencast-publication-service-oaipmh-remote","vulnerableRanges":["<17.6"],"patched":["17.6"],"from":["GHSA-j63h-hmgw-x4j7"],"provenance":"source"}],"euvd":{"id":"EUVD-2025-22765","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencast-cve-2021-43821","parents":[{"from":"CVE-2018-16153","to":"CVE-2025-54380","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-hcxx-mp6g-6gr9","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-j63h-hmgw-x4j7","via":"reference","url":"https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9"},{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6"],"basis":"shared function","functions":["addContentToRepo","getOrganizationDirectoryService"]}]},{"from":"CVE-2021-43821","to":"CVE-2025-54380","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764","https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6"],"basis":"shared function","functions":["addContentToRepo"]}]},{"from":"CVE-2022-29237","to":"CVE-2025-54380","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java"],"commits":["https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7","https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6"],"basis":"shared function","functions":["addContentToRepo"]}]}]}}