CVE-2017-1000217

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
VendorProductVersion
opencastopencast
𝑥
≤ 2.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://groups.google.com/a/opencast.org/forum/#%21topic/security-notices/sCpt0pIPEFg
https://groups.google.com/a/opencast.org/forum/#%21topic/security-notices/sCpt0pIPEFg