CVE-2022-41965
Opencast Authenticated OpenRedirect Vulnerability
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Opencast Authenticated OpenRedirect Vulnerability
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Record
CVE-2022-41965- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2022-7416
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Record
EUVD-2022-7416- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r3qr-vwvg-43f7
Authenticated OpenRedirect Vulnerability
Description Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.
Impact The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.
Patches This issue is fixed in Opencast 12.5 and newer
References Patch fixing the issue
If you have any questions or comments about this advisory: Open an issue in our issue tracker Email us at [email protected]
- Record
GHSA-r3qr-vwvg-43f7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Record
CVE-2022-41965- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Opencast Authenticated OpenRedirect Vulnerability
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.
- Record
CVE-2022-41965- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-r3qr-vwvg-43f7
Authenticated OpenRedirect Vulnerability
Description Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users.
Impact The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues.
Patches This issue is fixed in Opencast 12.5 and newer
References Patch fixing the issue
If you have any questions or comments about this advisory: Open an issue in our issue tracker Email us at [email protected]
- Record
GHSA-r3qr-vwvg-43f7- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opencastproject:opencast-commonMaven |
before 12.5 | 12.5 |
org.opencastproject:opencast-commonMaven |
before 12.5, plus listed versions 10.010.110.1010.1110.12 Show 45 moreShow less10.210.310.410.510.610.710.810.911.011.111.1011.1111.211.311.411.511.611.711.811.912.012.112.212.36.67.27.37.47.57.67.77.87.98.08.18.108.118.38.48.58.68.78.88.99.0 |
12.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-41965 is a medium vulnerability (CVSS 5.7) in Apereo Opencast, published November 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in org.opencastproject:opencast-common 12.5.
References
github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7
nvd.nist.gov/vuln/detail/CVE-2022-41965
Left out here: 11 versions. The JSON record has them.