6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54380

CVE-2025-54380: Opencast still publishes global system account credentials

Description

Opencast prior to versions 17.6 would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. The remainder are addressed with this patch.

Impact

Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing.

Patches

This issue is fixed in Opencast 17.6

If you have any questions or comments about this advisory:

Open an issue in our issue tracker
Email us at security@opencast.org

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54380

CVE-2025-54380:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.opencastproject:opencast-common	maven	< 17.6	17.6
org.opencastproject:opencast-ingest-service-impl	maven	< 17.6	17.6
org.opencastproject:opencast-kernel	maven	< 17.6	17.6
org.opencastproject:opencast-publication-service-oaipmh-remote	maven	< 17.6	17.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the fact that Opencast was sending hashed system credentials to arbitrary URLs specified in mediapackage files during the ingest process. The analysis of the patch 2d3219113e2b9fadfb06443f5468b1c2157827a6 reveals two key functions involved in this process.

First, org.opencastproject.ingest.impl.IngestServiceImpl.addContentToRepo is the function that initiates the download of external content. It takes a URI from the mediapackage and uses a TrustedHttpClient to fetch it. The previous attempt to fix a similar vulnerability involved a check within this function to see if the URL belongs to the cluster, but this was insufficient.

The root of the vulnerability is in org.opencastproject.kernel.security.TrustedHttpClientImpl.execute. Before the patch, this method unconditionally attached digest authentication credentials to all outgoing HTTP requests. This meant any service using this client would leak credentials if it made a request to an external, attacker-controlled server.

The patch addresses this by introducing a HostCache in TrustedHttpClientImpl. This cache maintains a list of known, trusted hosts belonging to the Opencast cluster. The execute method is modified to only add authentication credentials if the request's destination host is present in this cache. This ensures that credentials are no longer sent to arbitrary external servers, effectively fixing the vulnerability. Therefore, any runtime profile during exploitation would show IngestServiceImpl.addContentToRepo calling TrustedHttpClientImpl.execute.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-54380: Opencast still publishes global system account credentials

Description

Impact

Patches

CVE-2025-54380:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2025-54380: Opencast still publishes global system account credentials

Description

Impact

Patches

Technical Details

6.5

6.5

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI