{"id":"CVE-2025-54380","aliases":["EUVD-2025-22765","GHSA-j63h-hmgw-x4j7"],"status":"published","title":"Opencast still publishes global system account credentials","description":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00429,"percentile":0.37557,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-522"],"published":"2025-07-25T20:13:45Z","modified":"2026-10-28T10:59:49Z","fixes":[{"ecosystem":"Maven","package":"org.opencastproject:opencast-common","fixed_in":["17.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.opencastproject:opencast-ingest-service-impl","fixed_in":["17.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","fixed_in":["17.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.opencastproject:opencast-publication-service-oaipmh-remote","fixed_in":["17.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-ingest-service-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.opencastproject:opencast-publication-service-oaipmh-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}],"versions":["10.0","10.1","10.10","10.11","10.12","10.2","10.3","10.4","10.5","10.6","10.7","10.8","10.9","11.0","11.1","11.10","11.11","11.2","11.3","11.4","11.5","11.6","11.7","11.8","11.9","12.0","12.1","12.11","12.12","12.13","12.2","12.3","12.5","12.6","12.7","12.8","12.9","13.0","13.1","13.10","13.11","13.12","13.2","13.4","13.6","13.7","13.8","14.0","14.1","14.10","14.11","14.12","14.13","14.2","14.3","14.5","14.6","14.7","14.8","14.9","15.0","15.1","15.10","15.11","15.12","15.13","15.2","15.3","15.4","15.5","15.6","15.7","15.8","15.9","16.0","16.1","16.10","16.2","16.3","16.4","16.5","16.6","16.7","16.8","16.9","6.6","7.2","7.3","7.4","7.5","7.6","7.7","7.8","7.9","8.0","8.1","8.10","8.11","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.10","9.11","9.12","9.2","9.3","9.4","9.5","9.6","9.7","9.9"]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-ingest-service-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}],"versions":["10.0","10.1","10.10","10.11","10.12","10.2","10.3","10.4","10.5","10.6","10.7","10.8","10.9","11.0","11.1","11.10","11.11","11.2","11.3","11.4","11.5","11.6","11.7","11.8","11.9","12.0","12.1","12.11","12.12","12.13","12.2","12.3","12.5","12.6","12.7","12.8","12.9","13.0","13.1","13.10","13.11","13.12","13.2","13.4","13.6","13.7","13.8","14.0","14.1","14.10","14.11","14.12","14.13","14.2","14.3","14.5","14.6","14.7","14.8","14.9","15.0","15.1","15.10","15.11","15.12","15.13","15.2","15.3","15.4","15.5","15.6","15.7","15.8","15.9","16.0","16.1","16.10","16.2","16.3","16.4","16.5","16.6","16.7","16.8","16.9","6.6","7.2","7.3","7.4","7.5","7.6","7.7","7.8","7.9","8.0","8.1","8.10","8.11","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.10","9.11","9.12","9.2","9.3","9.4","9.5","9.6","9.7","9.9"]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}],"versions":["10.0","10.1","10.10","10.11","10.12","10.2","10.3","10.4","10.5","10.6","10.7","10.8","10.9","11.0","11.1","11.10","11.11","11.2","11.3","11.4","11.5","11.6","11.7","11.8","11.9","12.0","12.1","12.11","12.12","12.13","12.2","12.3","12.5","12.6","12.7","12.8","12.9","13.0","13.1","13.10","13.11","13.12","13.2","13.4","13.6","13.7","13.8","14.0","14.1","14.10","14.11","14.12","14.13","14.2","14.3","14.5","14.6","14.7","14.8","14.9","15.0","15.1","15.10","15.11","15.12","15.13","15.2","15.3","15.4","15.5","15.6","15.7","15.8","15.9","16.0","16.1","16.10","16.2","16.3","16.4","16.5","16.6","16.7","16.8","16.9","6.6","7.2","7.3","7.4","7.5","7.6","7.7","7.8","7.9","8.0","8.1","8.10","8.11","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.10","9.11","9.12","9.2","9.3","9.4","9.5","9.6","9.7","9.9"]},{"source":"osv","ecosystem":"Maven","package":"org.opencastproject:opencast-publication-service-oaipmh-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.6"}]}],"versions":["10.0","10.1","10.10","10.11","10.12","10.2","10.3","10.4","10.5","10.6","10.7","10.8","10.9","11.0","11.1","11.10","11.11","11.2","11.3","11.4","11.5","11.6","11.7","11.8","11.9","12.0","12.1","12.11","12.12","12.13","12.2","12.3","12.5","12.6","12.7","12.8","12.9","13.0","13.1","13.10","13.11","13.12","13.2","13.4","13.6","13.7","13.8","14.0","14.1","14.10","14.11","14.12","14.13","14.2","14.3","14.5","14.6","14.7","14.8","14.9","15.0","15.1","15.10","15.11","15.12","15.13","15.2","15.3","15.4","15.5","15.6","15.7","15.8","15.9","16.0","16.1","16.10","16.2","16.3","16.4","16.5","16.6","16.7","16.8","16.9","6.6","7.2","7.3","7.4","7.5","7.6","7.7","7.8","7.9","8.0","8.1","8.10","8.11","8.3","8.4","8.5","8.6","8.7","8.8","8.9","9.0","9.1","9.10","9.11","9.12","9.2","9.3","9.4","9.5","9.6","9.9"]}],"products":[{"vendor":"apereo","product":"opencast"},{"vendor":"opencast","product":"opencast"}],"references":[{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-j63h-hmgw-x4j7","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9","tags":["x_refsource_MISC","Not Applicable","advisory","web"]},{"url":"https://github.com/opencast/opencast/commit/e8980435342149375802648b9c9e696c9a5f0c9a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/opencast/opencast/commit/2d3219113e2b9fadfb06443f5468b1c2157827a6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54380","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j63h-hmgw-x4j7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54380.json","tags":["advisory"]},{"url":"https://github.com/opencast/opencast","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-54380","title":"Opencast still publishes global system account credentials","description":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","status":"published","published":"2025-07-26T03:28:25.194Z","modified":"2025-07-28T19:00:02.211Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-22765","description":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","status":"published","published":"2025-07-26T03:28:25Z","modified":"2025-07-28T19:00:02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:03.359865Z"}],"ghsa":[{"id":"GHSA-j63h-hmgw-x4j7","title":"Opencast still publishes global system account credentials ","description":"### Description\nOpencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.\n\n### Impact\nAnyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.\n\n### Patches\nThis issue is fixed in Opencast 17.6\n\nIf you have any questions or comments about this advisory:\n- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)\n- Email us at security@opencast.org","status":"published","published":"2025-07-25T20:13:45Z","modified":"2025-08-26T20:25:57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:38:54.795089Z"}],"nvd":[{"id":"CVE-2025-54380","description":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","status":"published","published":"2025-07-26T04:16:06.19Z","modified":"2026-06-17T09:39:57.343Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"CVE-2025-54380","title":"Opencast still publishes global system account credentials","description":"Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.","status":"published","published":"2025-07-26T03:28:25.194Z","modified":"2026-10-28T10:59:49.170253046Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"GHSA-j63h-hmgw-x4j7","title":"Opencast still publishes global system account credentials ","description":"### Description\nOpencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: `org.opencastproject.security.digest.user` and `org.opencastproject.security.digest.pass`) when attempting to fetch mediapackage elements included in a mediapackage XML file.  A [previous CVE](https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9) prevented many cases where the credentials were inappropriately sent, but not all.  The remainder are addressed with this patch.\n\n### Impact\nAnyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.\n\n### Patches\nThis issue is fixed in Opencast 17.6\n\nIf you have any questions or comments about this advisory:\n- Open an issue in our [issue tracker](https://github.com/opencast/opencast/issues)\n- Email us at security@opencast.org","status":"published","published":"2025-07-25T20:13:45Z","modified":"2026-02-04T02:31:03.239501Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-522"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}