Design/Logic Flaw

2016-04-1114:59:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

67.9%

JSON

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.

CPENameOperatorVersion
openmeetingsle3.1.0

CPE	Name	Operator	Version
	openmeetings	le	3.1.0

References

openmeetings.apache.org/security.html

packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html

www.securityfocus.com/archive/1/537887/100/0/threaded

www.apache.org/dist/openmeetings/3.1.1/CHANGELOG