Skip to content
Fencer Vulns
medium 6.5

CVE-2025-54380 json

Opencast still publishes global system account credentials

published 2025-07-25 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-22765 , GHSA-j63h-hmgw-x4j7

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly send the hashed global system account credentials (ie: org.opencastproject.security.digest.user and org.opencastproject.security.digest.pass) when attempting to fetch mediapackage elements included in a mediapackage XML file. A previous CVE prevented many cases where the credentials were inappropriately sent, but not all. Anyone with ingest permissions could cause Opencast to send its hashed global system account credentials to a url of their choosing. This issue is fixed in Opencast 17.6.

Patch / fix

  • maven org.opencastproject:opencast-common 17.6
  • maven org.opencastproject:opencast-ingest-service-impl 17.6
  • maven org.opencastproject:opencast-kernel 17.6
  • maven org.opencastproject:opencast-publication-service-oaipmh-remote 17.6
  • apereo opencast 17.6
  • org.opencastproject opencast-common 17.6
  • org.opencastproject opencast-ingest-service-impl 17.6
  • org.opencastproject opencast-kernel 17.6
  • org.opencastproject opencast-publication-service-oaipmh-remote 17.6

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
maven org.opencastproject:opencast-common
<17.6
17.6
maven org.opencastproject:opencast-ingest-service-impl
<17.6
17.6
maven org.opencastproject:opencast-kernel
<17.6
17.6
maven org.opencastproject:opencast-publication-service-oaipmh-remote
<17.6
17.6

Affected products

  • opencast opencast

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-522 Insufficiently Protected Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.