CVE-2025-61906
BaseFortify
Publication date: 2025-10-08
Last updated on: 2025-10-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apereo | opencast | to 17.8 (exc) |
| apereo | opencast | From 18.0 (inc) to 18.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Opencast versions prior to 17.8 and 18.2 causes the editor to accidentally publish videos without notifying the user. It happens when a user with write access to an event uses the editor and first clicks "Save & Publish" then selects the "Save" option. This sequence can unintentionally trigger the publishing workflow, leading to media being published that the user did not intend to publish. [2, 3]
How can this vulnerability impact me? :
The vulnerability can lead to accidental publishing of internal or sensitive media, potentially exposing content that was not meant to be public. Users may also get stuck in the editor with messages indicating the event is being processed, which affects usability and can cause further errors if changes continue during this state. [2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to the Opencast editor unintentionally publishing videos during specific user actions in the editor interface. Detection involves monitoring user actions in the Opencast editor, especially sequences where a user with write access clicks "Save & Publish" followed by "Save". There are no specific network or system commands provided to detect this vulnerability automatically. Instead, detection relies on reviewing user activity logs or audit trails within the Opencast system to identify unintended publish workflows being triggered. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, upgrade Opencast to version 17.8 or 18.2 or later, where the issue is fixed. The fix introduces explicit control over workflow initiation during saving operations, preventing accidental publishing. Until upgrading, restrict write access to trusted users only and educate users about the specific sequence of actions that can trigger accidental publishing to avoid unintentional exposure of media. [1, 3]