Detections
Analytics
SCA: security update for org.opencastproject:opencast-kernel (GHSA-94qw-r73x-j7hg)
medium Tenable Self-Hosted Container Security Plugin ID 423132
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to
create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast
which is referenced neither in the documentation nor in any code (except for tests) but only in the
security configuration. From the name – implying an admin for a specific course – users would never expect
that this role allows user creation. This issue is fixed in 7.6 and 8.1 which both ship a new default
security configuration. (CVE-2020-5231)
See Also
Plugin Details
Severity: Medium
ID: 423132
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 3/29/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N
CVSS Score Source: CVE-2020-5231
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/30/2020
Vulnerability Publication Date: 1/30/2020
Reference Information
CVE: CVE-2020-5231
cwe: CWE-285