PT-2017-17876 · Apache · Apache Openmeetings

Publicado 2017-07-14 · Atualizado 2022-05-13 · CVE-2017-7673

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings version 1.0.0

Description The issue concerns the use of weak cryptographic storage in Apache OpenMeetings. Additionally, the registration and forget password dialogs lack captcha, and authentication forms do not have brute force protection.

Recommendations For Apache OpenMeetings version 1.0.0, consider implementing stronger cryptographic storage mechanisms and adding captcha to the registration and forget password dialogs. As a temporary workaround, restrict access to authentication forms to minimize the risk of brute force attacks.

Correção

Improper Restriction of Excessive Authentication Attempts

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-307

CWE-326

Identificadores relacionados

CVE-2017-7673

GHSA-CQM6-HRGQ-6869

Produtos afetados

Apache Openmeetings

Referências · 6

• https://github.com/apache/openmeetings · Nota
• https://osv.dev/vulnerability/GHSA-cqm6-hrgq-6869 · Aviso do Fabricante
• http://securityfocus.com/bid/99587 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7673 · Nota de Segurança
• http://markmail.org/message/3hshl26omwjo6c5i · Nota
• https://osv.dev/vulnerability/CVE-2017-7673 · Aviso do Fabricante