CVE-2025-61906

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-61906", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-03T22:21:59.613Z", "datePublished": "2025-10-08T18:06:58.178Z", "dateUpdated": "2025-10-08T18:24:05.687Z"}, "containers": {"cna": {"title": "Opencast's editor accidentally publishes videos/overwrites publications #1626", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv"}, {"name": "https://github.com/opencast/opencast-editor/issues/1626", "tags": ["x_refsource_MISC"], "url": "https://github.com/opencast/opencast-editor/issues/1626"}, {"name": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91", "tags": ["x_refsource_MISC"], "url": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91"}], "affected": [{"vendor": "opencast", "product": "opencast", "versions": [{"version": "< 17.8", "status": "affected"}, {"version": ">= 18.0, < 18.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-08T18:06:58.178Z"}, "descriptions": [{"lang": "en", "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on \"Save & Publish\" before then selecting the \"Save\" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2."}], "source": {"advisory": "GHSA-x6vw-p693-jjhv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T18:23:56.149714Z", "id": "CVE-2025-61906", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T18:24:05.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-61906", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T18:23:56.149714Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T18:23:59.627Z"}}], "cna": {"title": "Opencast's editor accidentally publishes videos/overwrites publications #1626", "source": {"advisory": "GHSA-x6vw-p693-jjhv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "opencast", "product": "opencast", "versions": [{"status": "affected", "version": "< 17.8"}, {"status": "affected", "version": ">= 18.0, < 18.2"}]}], "references": [{"url": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv", "name": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/opencast/opencast-editor/issues/1626", "name": "https://github.com/opencast/opencast-editor/issues/1626", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91", "name": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on \"Save & Publish\" before then selecting the \"Save\" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-08T18:06:58.178Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61906", "state": "PUBLISHED", "dateUpdated": "2025-10-08T18:24:05.687Z", "dateReserved": "2025-10-03T22:21:59.613Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-08T18:06:58.178Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "opencast", "vendor": "opencast", "versions": [{"status": "affected", "version": "< 17.8"}, {"status": "affected", "version": ">= 18.0, < 18.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*", "matchCriteriaId": "4985831C-8FF6-4CC4-AFD9-1DCAD7888B5E", "versionEndExcluding": "17.8", "vulnerable": true}, {"criteria": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*", "matchCriteriaId": "33B836FD-FD4C-4FC2-9844-EF0DF0D4EB0D", "versionEndExcluding": "18.2", "versionStartIncluding": "18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on \"Save & Publish\" before then selecting the \"Save\" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2."}, {"lang": "es", "value": "Opencast es una plataforma gratuita de c\u00f3digo abierto para apoyar la gesti\u00f3n de contenido de audio y video educativo. Antes de Opencast 17.8 y 18.2, en algunas situaciones, el editor de Opencast puede publicar un video sin notificar al usuario. Esto puede llevar a que los usuarios publiquen accidentalmente contenido multimedia no destinado a la publicaci\u00f3n, y por lo tanto, posiblemente exponiendo contenido multimedia interno. Este riesgo de que esto realmente impacte a alguien es muy bajo, sin embargo. Esto solo puede ser activado por usuarios con acceso de escritura a un evento. Tambi\u00e9n tienen que usar el editor, lo cual es usualmente una acci\u00f3n tomada si quieren publicar contenido multimedia y no algo que los usuarios usar\u00edan en contenido multimedia interno que no quieren publicar. Finalmente, tienen que hacer clic primero en 'Save & Publish' antes de seleccionar la opci\u00f3n 'Save'. Sin embargo, aunque muy improbable, esto puede suceder. Este problema est\u00e1 solucionado en Opencast 17.8 y 18.2."}], "id": "CVE-2025-61906", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61906", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T18:23:56.149714Z", "version": "2.0.3"}}]}, "published": "2025-10-08T18:15:35.587", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/opencast/opencast-editor/issues/1626"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-09T12:51:38.206690+00:00", "updated": "2025-10-09T12:51:38.206735+00:00", "vendors": ["opencast", "opencast$PRODUCT$opencast"]}