Patchfirst
Patchfirst
CVE-2020-5231 Medium · 4.8 EPSS 0.6%

Opencast users with ROLE_COURSE_ADMIN can create new users

opencast · opencast

Official description · CVE.org

In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

Breakdown
13.3 / 100
Exploited
Not confirmed
Reports
0
Tactics
4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. What they do

  2. What can follow

Disclosed on 30 Jan 2020. No public exploit code or confirmed exploitation is recorded.

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Default Accounts T1078.001 also Persistence, Privilege Escalation, Stealth
MITRE CTID mapping of the CVE · primary impact

PersistenceTA0003

Create Account T1136
MITRE CTID mapping of the CVE · follow-on activity

Detection

0 rules for this CVE · 7 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-5231 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Default AccountsT1078.0014 general rules
Create AccountT11363 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: org.opencastproject:opencast-kernel.

Mavenorg.opencastproject:opencast-kernelGHSA-94qw-r73x-j7hg

Upgrade to 8.1 or later

Set the version to 8.1 or later in your pom.xml or build.gradle.

The first fix for CVE-2020-5231. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
8.0 up to 8.18.1
All versions before 7.67.6

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

2 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/opencast/opencast/security/advisories/GHSA-94qw-r73x-j7hg

x_refsource_MISC 1

github.com/opencast/opencast/commit/72fad0031d8a82c860e2bde0b27570c5042320ee
↑ ↓ chooseEnter openEsc close