Lucene search

GitHub Advisory DatabaseGHSA-CQM6-HRGQ-6869

HistoryMay 13, 2022 - 1:47 a.m.

Apache OpenMeetings has Inadequate Encryption Strength

2022-05-1301:47:04

CWE-326

GitHub Advisory Database

github.com

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

48.0%

JSON

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.

Affected configurations

Vulners

Node

org.apache.openmeetings\openmeetingsMatchparent

CPENameOperatorVersion
org.apache.openmeetings:openmeetings-parentge1.0.0
org.apache.openmeetings:openmeetings-parentlt3.3.0

CPE	Name	Operator	Version
	org.apache.openmeetings:openmeetings-parent	ge	1.0.0
	org.apache.openmeetings:openmeetings-parent	lt	3.3.0

References

markmail.org/message/3hshl26omwjo6c5i

www.securityfocus.com/bid/99587

github.com/advisories/GHSA-cqm6-hrgq-6869

nvd.nist.gov/vuln/detail/CVE-2017-7673

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

48.0%

JSON

Related for GHSA-CQM6-HRGQ-6869