PT-2021-17517 · Apache · Apache Openmeetings

Chi Tran + 2 · Published 2021-03-15 · Updated 2021-06-16 · CVE-2021-27576

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions prior to 6.0.0

Description The NetTest web service can be used to overload the bandwidth of an Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0.

Recommendations For versions prior to 6.0.0, update to Apache OpenMeetings 6.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the NetTest web service to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-27576

GHSA-PX9F-597F-WMCF

Affected Products

Apache Openmeetings

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2021-27576 · Security Note
• https://osv.dev/vulnerability/CVE-2021-27576 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px9f-597f-wmcf · Vendor Advisory
• https://lists.apache.org/thread.html/r9bb615bd70a0197368f5f3ffc887162686caeb0b5fc30592a7a871e9%40%3Cuser.openmeetings.apache.org%3E · Vendor Advisory
• https://github.com/apache/openmeetings/commit/060a3114ad759931aeb42cd9afa9d1ebb39d3075 · Note
• https://github.com/apache/openmeetings/commit/afe26c950b127776f2dfe920abff41a584874de8 · Note
• https://github.com/apache/openmeetings/commit/cbdfd2f9731a8fe3daa9b4adf5da4a063fde161d · Note
• https://t.me/cibsecurity/24887 · Telegram Post
• https://t.me/cvenotify/11328 · Telegram Post
• https://t.me/cvenotify/11711 · Telegram Post
• https://issues.apache.org/jira/browse/OPENMEETINGS-2551 · Note
• https://openmeetings.apache.org/security.html#cve-2021-27576---apache-openmeetings-bandwidth-can · Note