PT-2016-4411 · Apache · Apache Openmeetings

Andreas Lindh · Publicado 2016-04-11 · Atualizado 2018-10-09 · CVE-2016-0783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 3.1.1

Description The issue allows remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time, due to the generation of predictable password reset tokens by the sendHashByUser function.

Recommendations For versions prior to 3.1.1, update to version 3.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the password reset functionality until the update is applied.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-0783

Produtos afetados

Apache Openmeetings

Referências · 7

• https://apache.org/dist/openmeetings/3.1.1/CHANGELOG · Nota
• http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code · Nota
• http://securityfocus.com/archive/1/537886/100/0/threaded · Nota
• http://openmeetings.apache.org/security.html · Aviso do Fabricante
• http://packetstormsecurity.com/files/136432/Apache-OpenMeetings-3.1.0-MD5-Hashing.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0783 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0783 · Aviso do Fabricante