PT-2017-17884 · Apache · Apache Openmeetings

Published 2017-07-14 · Updated 2022-05-13 · CVE-2017-7685

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings version 1.0.0

Description The issue concerns Apache OpenMeetings responding to insecure HTTP methods. Specifically, it responds to PUT, DELETE, HEAD, and PATCH methods.

Recommendations For Apache OpenMeetings version 1.0.0, restrict access to the insecure HTTP methods to minimize the risk of exploitation. Consider disabling the PUT, DELETE, HEAD, and PATCH methods until a secure configuration or patch is available.

Fix

Related Identifiers

CVE-2017-7685

GHSA-2C3P-9J5F-33G3

Affected Products

Apache Openmeetings

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-7685 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7685 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c3p-9j5f-33g3 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• http://securityfocus.com/bid/99592 · Note
• http://markmail.org/message/uxk4bpq35svnyjhb · Note