Vulnerability · Published May 12, 2023 · Assigned by apache
CVE-2023-29246Apache OpenMeetings: allows null-byte Injection
High 7.2
In plain English
A high-severity improper input validation in Apache OpenMeetings from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.5%top 26.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.openmeetings:openmeetings-parent | 7.1.0 | GHSA-mg5h-f3q8-c96g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OpenMeetings | 2.0.0 – before 7.1.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr vendor-advisory