{"id":"CVE-2018-16153","published":"2023-12-12T00:00:00Z","modified":"2025-05-27T14:35:51Z","title":"An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. It sends system digest credentials during authentication attempts to arbitrary external services in some situations.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.00829,"percentile":0.5754,"provenance":"source"},"cwes":[{"id":"CWE-522","name":"Insufficiently Protected Credentials"}],"references":[{"url":"https://www.apereo.org/projects/opencast/news","tags":[]},{"url":"https://github.com/advisories/GHSA-hcxx-mp6g-6gr9","tags":[]},{"url":"https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51","tags":[]},{"url":"https://docs.opencast.org/r/10.x/admin/#changelog","tags":[]}],"priority":{"score":16.8,"factors":[{"name":"EPSS percentile","points":11.51},{"name":"CVSS severity","points":5.25}]},"affected":[{"ecosystem":"Maven","package":"org.opencastproject:opencast-common","vulnerableRanges":["<10.6"],"patched":["10.6"],"from":["GHSA-hcxx-mp6g-6gr9"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2529","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-opencast-cve-2018-16153","children":[{"from":"CVE-2018-16153","to":"CVE-2025-54380","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-hcxx-mp6g-6gr9","via":"related"},{"kind":"osv-related","provenance":"source","id":"GHSA-j63h-hmgw-x4j7","via":"reference","url":"https://github.com/opencast/opencast/security/advisories/GHSA-hcxx-mp6g-6gr9"}]}]}}