CVE-2022-29237

Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.

• CWE-287

• https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7Patch, Third Party Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-qm6v-cg9v-53j3Patch, Third Party Advisory
• https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7Patch, Third Party Advisory
• https://github.com/opencast/opencast/security/advisories/GHSA-qm6v-cg9v-53j3Patch, Third Party Advisory

Published

May 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29230Hydrogen is a React-based framework for building dynamic, Sh…5.4
• CVE-2022-29232BigBlueButton is an open source web conferencing system. Sta…6.5
• CVE-2022-29233BigBlueButton is an open source web conferencing system. In …4.3
• CVE-2022-29234BigBlueButton is an open source web conferencing system. Sta…4.3
• CVE-2022-29235BigBlueButton is an open source web conferencing system. Sta…5.3
• CVE-2022-29236BigBlueButton is an open source web conferencing system. Sta…4.3
• CVE-2022-29238Jupyter Notebook is a web-based notebook environment for int…4.3
• CVE-2022-2924Cross-site Scripting (XSS) - Stored in GitHub repository yet…5.4
• CVE-2022-29240Scylla is a real-time big data database that is API-compatib…8.1
• CVE-2022-29241Jupyter Server provides the backend (i.e. the core services,…8.8
• CVE-2022-29242GOST engine is a reference implementation of the Russian GOS…7.5
• CVE-2022-29243Nextcloud Server is the file server software for Nextcloud, …4.3