-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opencastproject:opencast-ingest-service-impl | maven | < 10.14 | 10.14 |
| org.opencastproject:opencast-ingest-service-impl | maven | >= 11.0, < 11.7 | 11.7 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how cluster URLs were validated in addContentToRepo. The pre-patch code used organizationDirectoryService.getOrganization(uri.toURL()) to determine allowed servers, which checks the organization associated with the input URI rather than the current user's organization. This allowed attackers to reference resources from other organizations. The patch replaced this with securityService.getOrganization(), which properly validates against the current user's organizational context. The function's role in media ingestion and the direct modification in the security fix confirm its vulnerability.
Ongoing coverage of React2Shell