CVE-2017-1000221

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Nov 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-10002235.4A stored web content injection vulnerability (WCI, a.k.a XSS) is present in MODX Revolution CMS version 2.5.6 and earlier. An authenticated CVE-2017-10002246.5CSRF in YouTube (WordPress plugin) could allow unauthenticated attacker to change any setting within the plugin CVE-2017-10002256.1Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anyt CVE-2017-10002265.3Stop User Enumeration 1.3.8 allows user enumeration via the REST API CVE-2017-10002275.4Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin c CVE-2017-10002289.8nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function CVE-2017-10002297.8Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 allows an attacker to remotely execute code or cause denial of servic CVE-2017-10002307.5The Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementatio CVE-2017-10002319.8A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors.CVE-2017-10002329.8A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors.CVE-2017-10002345.3I, Librarian version <=4.6 & 4.7 is vulnerable to Directory Enumeration in the jqueryFileTree.php resulting in attacker enumerating director CVE-2017-10002359.8I, Librarian version <=4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised.