PT-2023-3158 · Apache · Apache Openmeetings

Stefan Schiller · Published 2023-05-12 · Updated 2024-10-11 · CVE-2023-28936

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 2.0.0 through 7.1.0

Description The issue is related to insufficient comparison in the Apache OpenMeetings video conferencing software. Exploitation of this issue may allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Apache OpenMeetings versions 2.0.0 through 7.1.0, update to a version after 7.1.0 to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-697

CWE-284

Related Identifiers

BDU:2023-03257

CVE-2023-28936

GHSA-V93H-RWJ8-78QH

Affected Products

Apache Openmeetings

References · 12

• https://lists.apache.org/thread/y6vng44c22ll221rtvsv208x1pbjmdoc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28936 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03257 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-28936 · Security Note
• https://osv.dev/vulnerability/GHSA-v93h-rwj8-78qh · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• https://github.com/apache/openmeetings/commit/a28dea888fca1c5c3e0ce4c8a4c62f501aebe0cd · Note
• https://cybersecurity-help.cz/vdb/SB2023051207 · Note
• https://t.me/thehackernews/3624 · Telegram Post
• https://issues.apache.org/jira/browse/OPENMEETINGS-2762 · Note
• https://t.me/cybersecuritytechnologies/8755 · Telegram Post
• https://t.me/pentestingnews/35860 · Telegram Post