GitHub Advisoryadvisory · Maven

GHSA-335g-xcjh-ghc2 Apache OpenMeetings vulnerable to SQL injection

HIGH Published 2022-05-17 Modified 2022-11-22 Official page ↗
Aliases
CVE-2017-7681
Ecosystem
Maven
Packages
org.apache.openmeetings:openmeetings-parent
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2022-11-22

Affected packages

• Maven org.apache.openmeetings:openmeetings-parent: >= 1.0.0, < 3.3.0 → fixed in 3.3.0

Description

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0.

Related

Alias · CVE (1)

  • CVE-2017-7681 Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References