What’s Vulnerable › Vulnerabilities

CVE-2022-41965: Opencast Authenticated OpenRedirect Vulnerability

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-28 · updated 2026-06-17
• Weakness: CWE-601

Description

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer.

Affected products

• opencast: before 12.5 — fixed in 12.5

How to fix

Upgrade to a fixed version: opencast 12.5. Check the vendor advisory for mitigations.

References

• https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
• https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7
• https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
• https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7

Get alerted when CVE-2022-41965 or the next vulnerability affects your stack