Answer in brief
CVE-2018-16153 records a High severity (CVSS 7.5) vulnerability in Opencast publishes global system account credentials. The current sources do not mark it as known exploited. The current feed maps org.opencastproject:opencast-common (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps org.opencastproject:opencast-common (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| org.opencastproject:opencast-commonmaven | >=0 <10.6 | 10.6 |
Published upstream
Dec 14, 2021
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Aug 7, 2026
The issue was mostly mitigated before, drastically reducing the risk. See references below for more information. ### Impact Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system user's credentials, regardless of the target being part of the Opencast cluster or not. Previous mitigations already prevented clear text authentications for such requests (e.g. HTTP Basic authentication), but with enough malicious intent, even hashed credentials can be broken. ### Patches Opencast 10.6 will now send authentication requests only against servers which are part of the Opencast cluster, preventing external services from getting any form of authentication attempt in the first place. ### Workarounds No workaround available. ### References - [Patch fixing the issue](https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51) - [Original security notice](https://groups.google.com/a/opencast.org/g/security-notices/c/XRZzRiqp-NE) - [Original security mitigation](https://github.com/opencast/opencast/commit/fe8c3d3a60dc5869b468957270dbad5f8c30ead6) ### For more information If you have any questions or comments about this advisory: - Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues) - Email us at [[email protected]](mailto:[email protected])
Quoted source text, attributed separately from HOL analysis.