Description
Opencast before 7.6 and 8.1 enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. This problem is fixed in Opencast 7.6 and Opencast 8.1
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
opencast opencast
< 7.6affected>= 8.0, < 8.1affected