CVE-2020-5230

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system problems, can cause errors due to identifier mismatch since an identifier may unintentionally change. This issue is fixed in Opencast 7.6 and 8.1.

• CWE-99
• CWE-74

• https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317Patch
• https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmqThird Party Advisory
• https://github.com/opencast/opencast/commit/bbb473f34ab95497d6c432c81285efb0c739f317Patch
• https://github.com/opencast/opencast/security/advisories/GHSA-w29m-fjp4-qhmqThird Party Advisory

Published

Jan 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5224In Django User Sessions (django-user-sessions) before 1.7.1,…8.8
• CVE-2020-5225Log injection in SimpleSAMLphp before version 1.18.4. The ww…5.4
• CVE-2020-5226Cross-site scripting in SimpleSAMLphp before version 1.18.4.…5.4
• CVE-2020-5227Feedgen (python feedgen) before 0.9.0 is susceptible to XML …7.5
• CVE-2020-5228Opencast before 8.1 and 7.6 allows unauthorized public acces…7.5
• CVE-2020-5229Opencast before 8.1 stores passwords using the rather outdat…8.1
• CVE-2020-5231In Opencast before 7.6 and 8.1, users with the role ROLE_COU…6.5
• CVE-2020-5232A user who owns an ENS domain can set a trapdoor, allowing t…8.7
• CVE-2020-5233OAuth2 Proxy before 5.0 has an open redirect vulnerability. …6.1
• CVE-2020-5234MessagePack for C# and Unity before version 1.9.11 and 2.1.9…6.5
• CVE-2020-5235There is a potentially exploitable out of memory condition I…9.8
• CVE-2020-5236Waitress version 1.4.2 allows a DOS attack When waitress rec…6.5