Detections
Analytics

SCA: security update for org.opencastproject:opencast-common-jpa-impl (GHSA-h362-m8f2-5x7c)

high Tenable Cloud Security Plugin ID 422686

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash
 algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes
 for users with the same username and password to collide which is problematic especially for popular users
 like the default `admin` user. This essentially means that for an attacker, it might be feasible to
 reconstruct a user's password given access to these hashes. Note that attackers needing access to the
 hashes means that they must gain access to the database in which these are stored first to be able to
 start cracking the passwords. The problem is addressed in Opencast 8.1 which now uses the modern and much
 stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until
 the password is updated. For a list of users whose password hashes are stored using MD5, take a look at
 the `/user-utils/users/md5.json` REST endpoint. (CVE-2020-5229)

See Also

https://github.com/advisories/GHSA-h362-m8f2-5x7c

Plugin Details

Severity: High

ID: 422686

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.04

Vendor

Vendor Severity: Low

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2020-5229

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2020

Vulnerability Publication Date: 1/30/2020

Reference Information

CVE: CVE-2020-5229

cwe: CWE-327