Apache OpenMeetings missing authentication and can allow user impersonation

The Apache Software Foundation's OpenMeetings from 2.0.0 before 7.0.0 is missing authentication on meeting invitation URLs. An invitation URL contains a hash that automatically logs in as the invited user. An unauthorized user could obtain this URL and log in to the meeting as an invited user, in...

Design/Logic Flaw

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room...

CVE-2023-28326 Apache OpenMeetings: allows user impersonation

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room...

CVE-2023-28326 Apache OpenMeetings: allows user impersonation

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room...

CVE-2023-28326

CVE-2023-28326 affects Apache OpenMeetings 2.0.0 up to, but not including, 7.0.0. The root cause is an access control error where meeting invitation URLs lack authentication, enabling an attacker to impersonate users and elevate privileges within a meeting room. Publicly documented by GHSA and re...

Apache OpenMeetings 访问控制错误漏洞

Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system from the Apache Foundation. The product supports audio, video and allows users to view each participant's desktop, among other things. An access control error vulnerability exists in Apache OpenMeeting...

PT-2023-2090 · Apache · Apache Openmeetings

Name of the Vulnerable Software and Affected Versions: Apache OpenMeetings versions 2.0.0 through 6.x Description: The issue is related to a lack of authentication for a critical function in Apache OpenMeetings, allowing an attacker to elevate their privileges in any room. Specifically, the probl...

K67352212: Apache vulnerabilities CVE-2018-1286, CVE-2018-1294, CVE-2018-1316, CVE-2018-1319, and CVE-2018-1324

Security Advisory Description CVE-2018-1286 In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. CVE-2018-1294 If a user of Commons-Email typically an application programmer...

Apache OpenMeetings Denial of Service (CVE-2020-13951; CVE-2021-27576)

A denial of service vulnerability exists in Apache OpenMeetings. Successful exploitation of this vulnerability would allow remote attackers to cause denial of service on the affected system...

GHSA-67Q3-GWWW-PM4G Apache OpenMeetings does not correctly validate uploaded XML documents

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. The issue is fixed in version 3.3.0...

Apache OpenMeetings vulnerable to Cross-Site Request Forgery

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks. The issue is fixed in version 3.3.0...

Apache OpenMeetings vulnerable to SQL injection

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0...

Apache OpenMeetings Cross-site Scripting vulnerability

Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. The issue is fixed in version 3.3.0...

Apache OpenMeetings does not correctly validate uploaded XML documents

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. The issue is fixed in version 3.3.0...

GHSA-PXJ9-MW96-Q634 Apache OpenMeetings Cross-site Scripting vulnerability

Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. The issue is fixed in version 3.3.0...

Apache OpenMeetings displays Tomcat version and detailed error stack trace

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. The issue is fixed in version 3.3.0...

GHSA-4V67-WG88-37P9 Apache OpenMeetings displays Tomcat version and detailed error stack trace

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. The issue is fixed in version 3.3.0...

GHSA-335G-XCJH-GHC2 Apache OpenMeetings vulnerable to SQL injection

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0...

GHSA-M5PM-RGVF-VG22 Apache OpenMeetings vulnerable to Cross-Site Request Forgery

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery CSRF attacks, XSS attacks, click-jacking, and MIME based attacks. The issue is fixed in version 3.3.0...

GHSA-8XQ7-7HCX-8P8G Apache OpenMeetings Directory Traversal vulnerability

Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. dot dot in a ZIP archive entry...