PT-2025-3058 · Apache · Apache Openmeetings

M0D9 · Published 2025-01-08 · Updated 2026-03-27 · CVE-2024-54676

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache OpenMeetings versions 2.1.0 through 8.0.0

Description The default clustering instructions do not specify white/black lists for OpenJPA, leading to possible deserialization of untrusted data. This issue allows attackers to execute arbitrary code in cluster mode. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant openjpa.serialization.class.blacklist and openjpa.serialization.class.whitelist configurations.

Recommendations For Apache OpenMeetings versions 2.1.0 through 8.0.0, upgrade to version 8.0.0 and update the startup scripts to include the openjpa.serialization.class.blacklist and openjpa.serialization.class.whitelist configurations as shown in the documentation. As a temporary workaround, consider restricting access to the clustering feature until the issue is resolved.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-03166

CVE-2024-54676

GHSA-MJF9-4PCV-VFG7

Affected Products

Apache Openmeetings

References · 27

• https://nvd.nist.gov/vuln/detail/CVE-2024-54676 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54676 · Vendor Advisory
• https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03166 · Security Note
• https://osv.dev/vulnerability/GHSA-mjf9-4pcv-vfg7 · Vendor Advisory
• https://github.com/apache/openmeetings · Note
• https://github.com/apache/openmeetings/commit/1c3426c6d3abbd984a3c01a61decf1242ea38923 · Note
• https://twitter.com/Dinosn/status/2037144394046849464 · Twitter Post
• https://t.me/cvenotify/106739 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1877173203711213696 · Twitter Post
• https://issues.apache.org/jira/browse/OPENMEETINGS-2787 · Note
• https://twitter.com/TweetThreatNews/status/1877380411459772652 · Twitter Post
• http://openwall.com/lists/oss-security/2025/01/08/1 · Note
• https://twitter.com/VulmonFeeds/status/1876951856296997116 · Twitter Post
• https://t.me/cvedetector/14674 · Telegram Post