PT-2017-17876 · Apache · Apache Openmeetings

Published 2017-07-14 · Updated 2022-05-13 · CVE-2017-7673

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings version 1.0.0

Description The issue concerns the use of weak cryptographic storage in Apache OpenMeetings. Additionally, the registration and forget password dialogs lack captcha, and authentication forms do not have brute force protection.

Recommendations For Apache OpenMeetings version 1.0.0, consider implementing stronger cryptographic storage mechanisms and adding captcha to the registration and forget password dialogs. As a temporary workaround, restrict access to authentication forms to minimize the risk of brute force attacks.

Fix

Improper Restriction of Excessive Authentication Attempts

Inadequate Encryption Strength

Weakness Enumeration

CWE-307

CWE-326

Related Identifiers

CVE-2017-7673

GHSA-CQM6-HRGQ-6869

Affected Products

Apache Openmeetings

References · 6

• https://osv.dev/vulnerability/GHSA-cqm6-hrgq-6869 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7673 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7673 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• http://securityfocus.com/bid/99587 · Note
• http://markmail.org/message/3hshl26omwjo6c5i · Note