CVE-2017-1000217

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10002189.8LightFTP version 1.1 is vulnerable to a buffer overflow in the "writelogentry" function resulting a denial of services or a remote code exec CVE-2017-10002199.8npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user CVE-2017-10002209.8soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution CVE-2017-10002216.5In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will ha CVE-2017-10002235.4A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated CVE-2017-10002246.5CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin CVE-2017-10002256.1Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anyt CVE-2017-10002265.3Stop User Enumeration 1.3.8 allows user enumeration via the REST API CVE-2017-10002275.4Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin c CVE-2017-10002289.8nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function CVE-2017-10002297.8Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of servic CVE-2017-10002307.5The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementatio