Vulnerability · Published Jan 8, 2025 · Assigned by apache
CVE-2024-54676Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
Critical 9.8
In plain English
A critical-severity unsafe deserialization in Apache OpenMeetings from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 68.8% (higher than 99.3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.openmeetings:openmeetings-parent | 8.0.0 | GHSA-mjf9-4pcv-vfg7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OpenMeetings | 2.1 – before 8.0.0 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H