A high-severity cross-site scripting vulnerability in the Paella Player library allows authenticated users to execute malicious scripts within the context of the Opencast video platform.

This is a stored cross-site scripting (XSS) flaw (CWE-79) triggered via malicious closed captions cue text. The CVSS vector (PR:L/UI:R/S:C) indicates that while the attack requires low privileges and user interaction, it can result in a significant impact due to the cross-site scripting scope.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of other users, potentially leading to session hijacking, unauthorized actions, or information theft. Given the CVSS score of 8.7, this vulnerability poses a significant risk to the integrity and confidentiality of the Opencast platform and its users.

Immediate Action: Update Opencast to version 19.7 or 20.2, which includes the patched version of Paella Player (2.12.11).

Proactive Monitoring: Review application logs for suspicious input patterns within closed caption files or video metadata.

Compensating Controls: Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious payloads in user-submitted content.

Public Exploit Available: No

Organizations utilizing Opencast should prioritize the upgrade to the latest stable release to address this XSS vector. Failure to patch leaves the platform vulnerable to session compromise, and immediate remediation is recommended to ensure the security of administrative and user sessions.