CVE-2025-61906

{
  "id": "CVE-2025-61906",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-08T18:15:35.587",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, in some situations, Opencast's editor may publish a video without notifying the user. This may lead to users accidentally publishing media not meant for publishing, and thus possibly exposing internal media. This risk of this actually impacting someone is very low, though. This can only be triggered by users with write access to an event. They also have to use the editor, which is usually an action taken if they want to publish media and not something users would use on internal media they do not want to publish. Finally, they have to first click on \"Save & Publish\" before then selecting the \"Save\" option. Nevertheless, while very unlikely, this can happen. This issue is fixed in Opencast 17.8 and 18.2."
    },
    {
      "lang": "es",
      "value": "Opencast es una plataforma gratuita de código abierto para apoyar la gestión de contenido de audio y video educativo. Antes de Opencast 17.8 y 18.2, en algunas situaciones, el editor de Opencast puede publicar un video sin notificar al usuario. Esto puede llevar a que los usuarios publiquen accidentalmente contenido multimedia no destinado a la publicación, y por lo tanto, posiblemente exponiendo contenido multimedia interno. Este riesgo de que esto realmente impacte a alguien es muy bajo, sin embargo. Esto solo puede ser activado por usuarios con acceso de escritura a un evento. También tienen que usar el editor, lo cual es usualmente una acción tomada si quieren publicar contenido multimedia y no algo que los usuarios usarían en contenido multimedia interno que no quieren publicar. Finalmente, tienen que hacer clic primero en 'Save & Publish' antes de seleccionar la opción 'Save'. Sin embargo, aunque muy improbable, esto puede suceder. Este problema está solucionado en Opencast 17.8 y 18.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "opencast",
          "product": "opencast",
          "versions": [
            {
              "version": "< 17.8",
              "status": "affected"
            },
            {
              "version": ">= 18.0, < 18.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 2.3,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-08T18:23:56.149714Z",
          "id": "CVE-2025-61906",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "17.8",
              "matchCriteriaId": "4985831C-8FF6-4CC4-AFD9-1DCAD7888B5E"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "18.0",
              "versionEndExcluding": "18.2",
              "matchCriteriaId": "33B836FD-FD4C-4FC2-9844-EF0DF0D4EB0D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/opencast/opencast-editor/commit/98ba1934f08f623f1537a9675cc452d803766a91",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/opencast/opencast-editor/issues/1626",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ]
    },
    {
      "url": "https://github.com/opencast/opencast/security/advisories/GHSA-x6vw-p693-jjhv",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}