Lucene search

GitHub Advisory DatabaseGHSA-MG5H-F3Q8-C96G

HistoryMay 12, 2023 - 9:30 a.m.

Apache OpenMeetings vulnerable to remote code execution via null-bye injection

2023-05-1209:30:14

CWE-20

GitHub Advisory Database

github.com

vulnerability

remote code execution

apache openmeetings

null-byte injection

admin account access

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

30.7%

JSON

An attacker who has gained access to an admin account can perform RCE via null-byte injection

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

Affected configurations

Vulners

Node

org.apache.openmeetings\openmeetingsMatchparent

CPENameOperatorVersion
org.apache.openmeetings:openmeetings-parentge2.0.0
org.apache.openmeetings:openmeetings-parentlt7.1.0

CPE	Name	Operator	Version
	org.apache.openmeetings:openmeetings-parent	ge	2.0.0
	org.apache.openmeetings:openmeetings-parent	lt	7.1.0

References

github.com/advisories/GHSA-mg5h-f3q8-c96g

github.com/apache/openmeetings/commit/8e65a1344157b2898f2922d49a0bd2105687c4a5

github.com/apache/openmeetings/commit/9f12a48994d0ad741ac140c52cbd2152f0d048d5

github.com/apache/openmeetings/commit/f91ff1917027625f066a9007694a31d06e69df3a

issues.apache.org/jira/browse/OPENMEETINGS-2765

lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr

nvd.nist.gov/vuln/detail/CVE-2023-29246

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

30.7%

JSON

Related for GHSA-MG5H-F3Q8-C96G