Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zMzVnLXhjamgtZ2hjMs4AAbLh
Apache OpenMeetings vulnerable to SQL injection
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0.
Permalink: https://github.com/advisories/GHSA-335g-xcjh-ghc2JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zMzVnLXhjamgtZ2hjMs4AAbLh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: over 1 year ago
CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-335g-xcjh-ghc2, CVE-2017-7681
References:
- https://nvd.nist.gov/vuln/detail/CVE-2017-7681
- http://markmail.org/message/j774dp5ro5xmkmg6
- https://github.com/advisories/GHSA-335g-xcjh-ghc2
Affected Packages
maven:org.apache.openmeetings:openmeetings-parent
Dependent packages: 0Dependent repositories: 1
Downloads:
Affected Version Ranges: >= 1.0.0, < 3.3.0
Fixed in: 3.3.0
All affected versions: 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.2.0, 3.2.1
All unaffected versions: 3.3.0, 3.3.1, 3.3.2, 4.0.0, 4.0.1, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.9, 4.0.10, 4.0.11, 5.0.0, 5.1.0, 6.2.0, 6.3.0, 7.0.0, 7.2.0