CVE-2020-5231 - Opencast users with ROLE_COURSE_ADMIN can create new users

Back Back to CVE browser

MEDIUM

Opencast users with ROLE_COURSE_ADMIN can create new users

Published Jan 30, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 0.63%

Description

In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

Affected products

Vendor Opencast Product Opencast Default
n/a
- Version
  < 7.6
  Status
  affected
  Constraints
  -
- Version
  >= 8.0, < 8.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Opencast

n/a

Version	Status	Constraints
< 7.6	affected	-
>= 8.0, < 8.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-276

Incorrect Default Permissions

CWE-285

References (4)

https://github.com/advisories/GHSA-94qw-r73x-j7hg
Advisory
https://github.com/opencast/opencast/commit/72fad0031d8a82c860e2bde0b27570c5042320ee
x_refsource_MISCPatch
https://github.com/opencast/opencast/security/advisories/GHSA-94qw-r73x-j7hg
x_refsource_CONFIRMExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-5231

Link	Providers	Tags
https://github.com/advisories/GHSA-94qw-r73x-j7hg		Advisory
https://github.com/opencast/opencast/commit/72fad0031d8a82c860e2bde0b27570c5042320ee		x_refsource_MISCPatch
https://github.com/opencast/opencast/security/advisories/GHSA-94qw-r73x-j7hg		x_refsource_CONFIRMExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-5231