PT-2017-17870 · Apache · Apache Openmeetings

Published 2017-07-14 · Updated 2022-05-17 · CVE-2017-7664

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 3.1.0 through 3.2.x

Description The issue arises from the incorrect validation of uploaded XML documents. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the lack of proper validation of XML documents.

Recommendations For Apache OpenMeetings versions 3.1.0 through 3.2.x, update to version 3.3.0 to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-7664

GHSA-67Q3-GWWW-PM4G

Affected Products

Apache Openmeetings

References · 6

• https://osv.dev/vulnerability/GHSA-67q3-gwww-pm4g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7664 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7664 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• http://securityfocus.com/bid/99576 · Note
• http://markmail.org/message/cwr552iapmhukb45 · Note