PT-2018-11442 · Apache · Apache Openmeetings

Sahil Dhar · Publicado 2018-02-28 · Atualizado 2022-05-13 · CVE-2018-1286

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 3.0.0 through 4.0.1

Description The issue allows an authenticated attacker to deny service for privileged users due to the lack of password protection for CRUD operations on these users.

Recommendations For versions 3.0.0 through 4.0.1, update to version 4.0.2 to resolve the issue.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-1286

GHSA-CV9J-7Q4X-V2G2

Produtos afetados

Apache Openmeetings

Referências · 6

• https://github.com/apache/openmeetings · Nota
• https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8%40%3Cuser.openmeetings.apache.org%3E · Nota
• https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8@%3Cuser.openmeetings.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-cv9j-7q4x-v2g2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1286 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1286 · Aviso do Fabricante