Apache OpenMeetings may allow authenticated attacker to deny service for privileged users

2022-05-1301:49:39

Google

osv.dev

0.001 Low

EPSS

Percentile

41.3%

JSON

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. The issue is fixed in version 4.0.2.

CPENameOperatorVersion
org.apache.openmeetings:openmeetings-parenteq3.1.5
org.apache.openmeetings:openmeetings-parenteq3.2.0
org.apache.openmeetings:openmeetings-parenteq3.2.1
org.apache.openmeetings:openmeetings-parenteq3.3.2
org.apache.openmeetings:openmeetings-parenteq3.3.0
org.apache.openmeetings:openmeetings-parenteq4.0.1
org.apache.openmeetings:openmeetings-parenteq3.1.4
org.apache.openmeetings:openmeetings-parenteq3.1.3
org.apache.openmeetings:openmeetings-parenteq4.0.0
org.apache.openmeetings:openmeetings-parenteq3.1.2

Name	Operator	Version
org.apache.openmeetings:openmeetings-parent	eq	3.1.5
org.apache.openmeetings:openmeetings-parent	eq	3.2.0
org.apache.openmeetings:openmeetings-parent	eq	3.2.1
org.apache.openmeetings:openmeetings-parent	eq	3.3.2
org.apache.openmeetings:openmeetings-parent	eq	3.3.0
org.apache.openmeetings:openmeetings-parent	eq	4.0.1
org.apache.openmeetings:openmeetings-parent	eq	3.1.4
org.apache.openmeetings:openmeetings-parent	eq	3.1.3
org.apache.openmeetings:openmeetings-parent	eq	4.0.0
org.apache.openmeetings:openmeetings-parent	eq	3.1.2