GitHub Advisoryadvisory · Maven

GHSA-f6vf-465r-h42p Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

HIGH Published 2022-05-14 Modified 2022-11-22 Official page ↗
Aliases
CVE-2016-2164
Ecosystem
Maven
Packages
org.apache.openmeetings:openmeetings-parent
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-11-22

Affected packages

• Maven org.apache.openmeetings:openmeetings-parent: < 3.1.1 → fixed in 3.1.1

Description

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.

Related

Alias · CVE (1)

  • CVE-2016-2164 The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References